Security and API keys Beta
Use model keys and account access safely while keeping sensitive data out of shared prompts.
01 Key handling
Treat API keys as production credentials. Store them only in the settings area designed for key management and rotate them when access changes.
ROTATE ON EXPOSURE
If a key ever appears in a screenshot, log, or shared prompt, treat it as compromised — revoke it at the provider and issue a new one before anything else.
- 1Never paste secrets into support chat, screenshots, or public issues.
- 2Use provider-side limits where available.
- 3Remove keys that are no longer needed.
02 Account safety
Use a unique password and keep billing access limited to trusted account owners. Contact support if you suspect unauthorized access.
POST /wp-admin/admin-ajax.php?action=save_api_key
curl -X POST https://stratcraft.ai/wp-admin/admin-ajax.php \
-d action=save_api_key \
-d provider=anthropic \
-d api_key=sk-ant-*** \
-d _wpnonce=$NONCERequest parameters
FieldTypeDescription
actionstringAlways save_api_key for this endpoint.providerenumOne of anthropic, openai, google.api_keystringThe provider secret. Sent once, stored encrypted, never returned._wpnoncestringCSRF nonce from the settings page. Expires with the session.03 Account safety
Use a unique password and keep billing access limited to trusted account owners. Contact support if you suspect unauthorized access.
Was this guide helpful?
Your answer helps us decide which guides to expand next.