Skip to content
ajan.io

Docs menu

On this page

API Key Best Practices

Keep your ajan API keys safe and secure with these best practices for key management.

API keys are sensitive credentials that provide access to your ajan account and resources. Protecting them is essential to maintain the security of your applications and data. This guide outlines best practices for managing your ajan API keys safely.

  • Manage Workspace API Keys — Workspace admins create, view, and revoke workspace API keys in Workspace Settings → Products → API.

Members with access create and manage personal API keys in their account settings.

Why API Key Security Matters

Your ajan API keys grant access to your account's AI capabilities and data. If compromised, unauthorized users could:

  • Access your ajan resources and incur unexpected costs
  • Expose sensitive data processed through your applications
  • Abuse your account for malicious purposes
  • Violate your organization's compliance requirements

Best Practices for API Key Management

Never Hardcode API Keys

python
from openai import OpenAI

client = OpenAI(
    base_url="https://api.ajan.io/openai/eu/v1",
    api_key="sk-ld-a1b2c3d4e5f6g7h8i9j0..."  # Never do this!
)

Hardcoding API keys in your source code exposes them to anyone with access to your codebase, including version control history.

Use Environment Variables

Store your API keys in environment variables rather than in your code. This separates configuration from code and makes it easier to manage different keys across environments.

1. Create a .env file in your project directory and add your API key:

bash
AJAN_API_KEY=your-api-key-here

2. Install the python-dotenv package:

bash
pip install python-dotenv

3. Load your API key into your Python script:

python
from dotenv import load_dotenv
from openai import OpenAI
import os

load_dotenv()

client = OpenAI(
    base_url="https://api.ajan.io/openai/eu/v1",
    api_key=os.environ.get("AJAN_API_KEY")
)

Keep Keys Out of Version Control

Add files containing sensitive credentials to your .gitignore file to prevent accidentally committing them:

bash
# .gitignore
.env
.env.local
config/secrets.yml
credentials.json

Use Different Keys for Different Use Cases

Personal API keys are tied to one member's identity and usage budget. Never share a personal API key. Use a separate workspace API key for each shared application, environment, or team. This practice:

  • Limits the impact if a key is compromised
  • Helps track usage by application or team
  • Makes key rotation easier
  • Provides better audit trails

For example, use separate keys for:

  • Development vs. production environments
  • Different applications using the ajan API
  • Different teams or departments in your organization

Never Expose API Keys in Browser Requests

API keys should never be exposed in client-side code because they would be:

  • Visible in browser network traffic
  • Accessible through browser developer tools
  • Extractable from JavaScript source code
  • Exposed to any user of your application

Your backend server should securely store the API key using the best practices described above and make requests to ajan on behalf of your users.

Implement Key Rotation

Regularly rotate your API keys to minimize the risk of long-term exposure. For a personal API key, select Rotate key in your account settings and update every connected tool with the new key. For a workspace API key, rotate manually:

  1. Generate a new API key
  2. Update your applications to use the new key
  3. Monitor to ensure the transition is successful
  4. Revoke the old key after confirming the new one works

Monitor Usage and Set Limits

Regularly review your API usage in the ajan dashboard to detect any unusual patterns that might indicate a compromised key. Set up usage alerts and spending limits where possible to protect against unexpected charges from leaked keys.

What to Do If Your API Key Is Compromised

If you suspect your API key has been exposed:

  1. Immediately revoke the key, personal keys in your account settings and workspace keys in Workspace Settings → Products → API
  2. Generate a new key
  3. Update your applications to use the new key
  4. Review your account activity for any unauthorized usage
  5. Contact ajan support if you notice suspicious activity
  6. Document the incident for your security records

Need Help?

If you have questions about API key security or need assistance with your ajan account:

  • Contact our support team at support@ajan.com
  • Review our Terms of Service and Privacy Policy for additional information