Gonka24

Production

Keep API keys safe

Treat a Gonka24 API key as a server credential: limit where it lives, rotate it quickly, and never expose it to a browser.

Store keys server-side

Load GONKA24_API_KEY from your deployment platform's secret store or a local environment file that is excluded from Git. Send Gonka24 requests from a server, worker, or trusted local CLI — not directly from browser JavaScript, a mobile app bundle, or a public static site.

Separate environments

Use distinct keys for local development, staging, and production when your dashboard setup allows it. This makes it easier to revoke an exposed development credential without interrupting production traffic and to attribute usage during incident review.

Rotate exposed keys

  1. Create a replacement key in the dashboard.
  2. Update the secret in every affected service and deploy it.
  3. Verify a request succeeds with the replacement key.
  4. Revoke the exposed key, then remove it from source history, logs, or screenshots where possible.

Before you ship

  • Confirm the repository ignores local environment files.
  • Redact authorization headers from application logs and support attachments.
  • Use a live model ID fetched from /v1/models, not a copied name from old documentation.
  • Implement a controlled retry strategy for transient failures.