> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mailofly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Key Security

> Best practices for keeping your Mailofly API keys safe.

Protecting your API keys prevents unauthorized access and protects your sending reputation from spam abuse.

***

## Security Best Practices

1. **Never Commit to Source Control**: Store API keys in environment variables (`MAILOFLY_API_KEY`) and add `.env` to `.gitignore`.
2. **Never Use in Client-Side Code**: Never expose your secret API key in React, Next.js client components (`NEXT_PUBLIC_`), iOS, Android, or browser JavaScript. All email requests should go through a backend API route.
3. **Use Scoped Keys**: Give production servers keys with the minimum required permissions (e.g. `Sending Only`).
4. **Regular Rotation**: Rotate API keys periodically by creating a new key, deploying your server, and revoking the old key.


## Related topics

- [Introduction](/guides/introduction.md)
- [Manage API Keys](/guides/api-keys/manage-api-keys.md)
- [Leaked API Keys](/guides/api-keys/leaked-api-keys.md)
- [Create API key](/getting-started/api-keys.md)
- [AI onboarding](/getting-started/ai-onboarding.md)