> ## Documentation Index
> Fetch the complete documentation index at: /docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API Key Security

> Best practices for keeping your Mailofly API keys safe.

Protecting your API keys prevents unauthorized access and protects your sending reputation from spam abuse.

***

## Security Best Practices

1. **Never Commit to Source Control**: Store API keys in environment variables (`MAILOFLY_API_KEY`) and add `.env` to `.gitignore`.
2. **Never Use in Client-Side Code**: Never expose your secret API key in React, Next.js client components (`NEXT_PUBLIC_`), iOS, Android, or browser JavaScript. All email requests should go through a backend API route.
3. **Use Scoped Keys**: Give production servers keys with the minimum required permissions (e.g. `Sending Only`).
4. **Regular Rotation**: Rotate API keys periodically by creating a new key, deploying your server, and revoking the old key.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.