API Key Storage

• Keys are shown only once at creation. Save them immediately.
• Do not put keys in frontend code, git repos, public docs, or screenshots.
• Use environment variables or a secret manager for server-side scripts.

One Key Per Integration

Create a separate key for each automation task. If one leaks or is abused, revoke only that key.

Rotation

• Rotate keys regularly, especially for long-running scripts.
• Revoke and recreate immediately if you suspect a leak.
• Use the disable feature to pause a key before replacing it.

Transport

• Use https://api.h3hub.cn in production.
• Do not put keys in URL parameters; use headers.

Rate Limits

• Watch X-RateLimit-Limit / X-RateLimit-Remaining to plan ahead.
• On 429, back off using Retry-After.

Logs

• Do not print full keys.
• Keep only the prefix (e.g. h3k_abc123…) in logs for identification.