Essential rules

  • Never place keys in frontend code or public repositories
  • Never paste complete keys into chats, tickets, or screenshots
  • Use separate keys for devices, projects, and environments
  • Set spending, IP, rate, and expiration limits where possible
  • Disable and replace a key immediately after suspected exposure

Use environment variables

bash
# macOS / Linux
export MILOROUTER_API_KEY="your-key"

# PowerShell
$env:MILOROUTER_API_KEY="your-key"