API Key Security

⚠️ Never expose the key in client-side code (browser/mobile app)

Anyone inspecting network traffic or source code can steal it and consume your tokens.

Correct approach: backend proxy

Your frontend calls your server, which keeps the key in environment variables and calls NeuralAI. The client never sees the key.

.env (mai committare questo file)
# ✅ Tieni la chiave nelle variabili d'ambiente del server
NEURALAI_API_KEY=LA_TUA_CHIAVE_API

# ❌ NON fare questo nel frontend
// const API_KEY = "LA_TUA_CHIAVE_API"; // visibile a chiunque!
Node.js / Express — backend proxy
import express from "express";
import fetch from "node-fetch";

const app = express();
app.use(express.json());
Next.js — API Route (pages/api/ai.js)
// pages/api/ai.js  ← solo lato server, mai nel bundle browser

export default async function handler(req, res) {
  if (req.method !== "POST") return res.status(405).end();
Python / FastAPI — backend proxy
import os
import httpx
from fastapi import FastAPI, HTTPException
from pydantic import BaseModel

🔑 API Key Scopes

Each API key can have one or more scopes that limit its functionality. Assign only the scopes needed for your use case.

chatAI conversation, RAG with documents
imageImage generation and editing (Imagen 4)
videoVideo generation (Gemini)
musicMusic composition (Lyria 3)
searchSeek Speed / Normal / Large / Deep Research
uploadFile and document upload
server_virtual🖥️ Virtual Servers access — REQUIRED to create servers
⚠️ Virtual Servers: to create a Virtual Server you must select an API key with server_virtual scope active. The "Create Server" button is disabled without a valid key. The system checks the scope on every execution and shows warnings in the terminal if the key is no longer valid.

🔒 Environment variables

Use .env locally, Secret Manager (AWS/GCP/Azure) in production. Never commit .env files to the repository.

🌐 Domain restriction

In the API Keys section you can limit the key to specific domains for a second level of protection.

🔄 Periodic rotation

Rotate the key every 30-90 days. Create the new one first, update the server, then revoke the old one.

📊 Monitor usage

Check the Statistics tab regularly. Anomalous token spikes = compromised key → immediate revocation.