> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zelinqa.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API Key Safety

> Best practices for keeping your NBQ Engine API key secure.

Your NBQ Engine API key grants full access to your configuration and usage. Treat it like a password.

## Key facts

<CardGroup cols={2}>
  <Card title="Format" icon="key">
    Every key starts with `nbq_live_` followed by a random string.
  </Card>

  <Card title="Shown once" icon="eye-slash">
    The key is displayed only at generation. It cannot be retrieved again.
  </Card>

  <Card title="Revocable immediately" icon="ban">
    You can revoke a key instantly from the NBQ Studio API Keys area.
  </Card>

  <Card title="No automatic expiry" icon="clock">
    Keys do not expire automatically. Rotate them periodically as a best practice.
  </Card>
</CardGroup>

## Do and do not

<Tabs>
  <Tab title="Do">
    * Store the key in an environment variable or secrets manager (AWS Secrets Manager, Doppler, HashiCorp Vault).
    * Rotate the key when team members with access leave.
    * Revoke the key immediately if you suspect it has been exposed.
    * Use the key server-side only — never in frontend or client-side code.
  </Tab>

  <Tab title="Do not">
    * Never hardcode the key in source code.
    * Never commit the key to GitHub or any version control system, even in a private repository.
    * Never share the key in Slack, email, or other messaging tools.
    * Never expose the key in browser developer tools or client-side JavaScript.
  </Tab>
</Tabs>

## If your key is compromised

<Steps>
  <Step title="Revoke immediately">
    Go to the NBQ Studio API Keys area and click **Revoke**. The key stops working instantly.
  </Step>

  <Step title="Generate a new key">
    Click **Generate Key** to create a replacement. Copy it immediately.
  </Step>

  <Step title="Update your integration">
    Replace the old key in your environment variables or secrets manager and redeploy.
  </Step>

  <Step title="Review your logs">
    Check API usage logs for any unexpected calls made while the key was potentially exposed.
  </Step>
</Steps>

<Warning>
  Never commit an API key to GitHub, even in a private repository. Use `.gitignore` to exclude `.env` files. If a key was ever committed, revoke it immediately — git history is permanent and may be inspected.
</Warning>