Complete guide to securing your AI API integrations. API key management, data privacy, encryption standards, and compliance. Learn how Token1.US protects your data and how to implement security best practices in your applications.
| Layer | Technology | Standard |
|---|---|---|
| Data in transit | TLS 1.3 | Latest industry standard, forward secrecy |
| API keys at rest | AES-256 | Bank-grade encryption |
| Connection security | HSTS + HTTPS only | Forced HTTPS, no plaintext fallback |
| Request integrity | Bearer token auth | Per-request authentication |
// Frontend JavaScript - API key exposed!
const API_KEY = "sk-your-secret-key";
fetch("https://discount-token.com/v1/chat/completions", {
headers: { "Authorization": `Bearer ${API_KEY}` }
})Correct approach: Always proxy API requests through your backend server:
// Backend (Node.js/Express)
app.post('/api/chat', async (req, res) => {
const response = await fetch('https://discount-token.com/v1/chat/completions', {
headers: {
'Authorization': `Bearer ${process.env.AI_API_KEY}`,
'Content-Type': 'application/json'
},
body: JSON.stringify(req.body)
});
res.json(await response.json());
});# .env file (NEVER commit to git)
AI_API_KEY=sk-your-token1-key
AI_BASE_URL=https://discount-token.com/v1
# Python
import os
from openai import OpenAI
client = OpenAI(
api_key=os.environ['AI_API_KEY'],
base_url=os.environ['AI_BASE_URL']
)| Environment | Key Strategy | Spending Limit |
|---|---|---|
| Development | Separate key, GLM-4-Flash (free) | $0-5/month |
| Staging | Separate key, budget models | $20/month |
| Production | Production key, all models | Based on traffic |
Recommended rotation frequency: Every 90 days for production keys, immediately if a key may have been compromised.
Token1.US supports configurable spending limits to prevent unexpected charges:
Never call AI APIs directly from the browser. Always route through your backend:
# Python Flask example
from flask import Flask, request, jsonify
import os
app = Flask(__name__)
@app.route('/api/ai/chat', methods=['POST'])
def chat():
# Validate user authentication
if not is_authenticated(request):
return jsonify({'error': 'Unauthorized'}), 401
# Validate and sanitize input
user_message = request.json.get('message', '')
if not user_message or len(user_message) > 10000:
return jsonify({'error': 'Invalid input'}), 400
# Call AI API from backend (key never exposed to client)
response = call_ai_api(user_message)
# Log for audit (without storing sensitive content)
log_request(user_id=request.user.id, tokens_used=response.usage.total_tokens)
return jsonify({'response': response.choices[0].message.content})# Simple per-user rate limiting (Redis)
import redis
import time
r = redis.Redis()
def check_rate_limit(user_id, limit=60, window=60):
key = f"rate_limit:{user_id}"
current = r.incr(key)
if current == 1:
r.expire(key, window)
return current <= limit
if not check_rate_limit(user_id):
return jsonify({'error': 'Rate limit exceeded'}), 429API requests are processed through global CDN edge nodes. The processing location depends on the model provider's infrastructure. For specific data residency requirements, contact support to discuss enterprise options.
For enterprise customers, Token1.US provides: