⚠️ Never expose the key in client-side code (browser/mobile app)
Anyone inspecting network traffic or source code can steal it and consume your tokens.
Correct approach: backend proxy
Your frontend calls your server, which keeps the key in environment variables and calls NeuralAI. The client never sees the key.
# ✅ Tieni la chiave nelle variabili d'ambiente del server NEURALAI_API_KEY=LA_TUA_CHIAVE_API # ❌ NON fare questo nel frontend // const API_KEY = "LA_TUA_CHIAVE_API"; // visibile a chiunque!
import express from "express"; import fetch from "node-fetch"; const app = express(); app.use(express.json());
// pages/api/ai.js ← solo lato server, mai nel bundle browser
export default async function handler(req, res) {
if (req.method !== "POST") return res.status(405).end();
import os import httpx from fastapi import FastAPI, HTTPException from pydantic import BaseModel
🔑 API Key Scopes
Each API key can have one or more scopes that limit its functionality. Assign only the scopes needed for your use case.
chatAI conversation, RAG with documentsimageImage generation and editing (Imagen 4)videoVideo generation (Gemini)musicMusic composition (Lyria 3)searchSeek Speed / Normal / Large / Deep ResearchuploadFile and document uploadserver_virtual🖥️ Virtual Servers access — REQUIRED to create servers🔒 Environment variables
Use .env locally, Secret Manager (AWS/GCP/Azure) in production. Never commit .env files to the repository.
🌐 Domain restriction
In the API Keys section you can limit the key to specific domains for a second level of protection.
🔄 Periodic rotation
Rotate the key every 30-90 days. Create the new one first, update the server, then revoke the old one.
📊 Monitor usage
Check the Statistics tab regularly. Anomalous token spikes = compromised key → immediate revocation.