API Key Management

Never Hardcode Keys

Store API keys in a secrets manager, not in code or environment variables:

# Bad - hardcoded
api_key = "<your-api-key>"
 
# Better - environment variable
import os
api_key = os.environ["OPENAI_API_KEY"]
 
# Best - secrets manager
from your_secret_manager import get_secret
api_key = get_secret("openai-api-key")

Key Rotation

Rotate API keys regularly, without downtime: add the new key alongside the old one, confirm requests succeed on the new key, and only then revoke the old one.

Key Scoping

Use the minimum permissions required. Most LLM providers support scoped API keys:

OpenAI — Create project-specific keys with model restrictions
Anthropic — Use workspace-scoped keys
Google — Use service accounts with IAM roles

Network Security

TLS Everywhere

Call LLM providers over TLS, and do not disable certificate verification in production.

Request Validation

Validate inputs before sending to LLM providers:

from agenticraft_types import CompletionRequest
 
# Pydantic validates the request shape
request = CompletionRequest(
    model="gpt-5-mini",
    messages=[{"role": "user", "content": user_input}],
    max_tokens=1000,
)

Agent Communication Security

When building multi-agent systems:

Validate all inter-agent messages — don't trust agent outputs without validation
Scope agent permissions — each agent should only access the tools and data it needs
Log agent actions — maintain an audit trail of agent decisions
Set output limits — configure max_tokens to prevent runaway generation
Monitor for prompt injection — validate that agent inputs don't contain adversarial prompts

Rate Limiting

Protect your infrastructure from excessive usage: throttle outbound requests below each provider's quota, and allow short bursts rather than raising the steady rate.

Operational Security

Audit logging — Log all LLM API calls with timestamps, models used, and token counts (never log prompt content in production)
Cost alerts — Set budget alerts per provider to catch runaway costs
Access control — Restrict who can modify provider configurations and API keys
Incident response — Have a playbook for provider outages and key compromises

Next Steps

Production Deployment — deployment checklists
Types API Reference — error handling and validation