MoonApiX Docs

English

简体中文

English

简体中文

Appearance

API key security ​

Your MoonApiX API key grants access to your account's quota and models. Use it only in a trusted server environment.

Usage recommendations ​

  • Never place a key in frontend source, mobile packages, public repositories, screenshots or logs.
  • Use <MOONAPIX_API_KEY> in documentation examples.
  • Use separate keys for local development, testing and production.
  • Rotate a key in the MoonApiX console if it appears in chats, screenshots, logs or public repositories.

Environment variables ​

Store API keys in server environment variables:

bash
MOONAPIX_API_KEY=<MOONAPIX_API_KEY>

Node.js:

js
const apiKey = process.env.MOONAPIX_API_KEY

Python:

python
import os

api_key = os.environ["MOONAPIX_API_KEY"]

Request example ​

http
Authorization: Bearer <MOONAPIX_API_KEY>

Do not place a key in a URL query string, as in this unsafe pattern:

text
https://moonapix.com/v1/models?api_key=...

Frontend applications ​

Browser and mobile applications should call your own application server:

  1. The frontend sends a request to your backend.
  2. Your backend verifies the user's identity and permissions.
  3. Your backend calls MoonApiX with its API key.
  4. Your backend returns the required result to the frontend.

This keeps the key out of browser developer tools, client network captures and distributed application packages.

Logging ​

  • Log the request path, status code, task_id and your application's order ID.
  • Do not log the Authorization header.
  • Do not log sensitive user data from complete request bodies.
  • For failures, record error.code and error.message.

Rotation ​

  • Maintain separate keys for development, tests and production.
  • Delete temporary test keys promptly after use.
  • Rotate keys when a team member leaves, a repository becomes public, logs are shared or a key is copied into chat.
  • Deploy the replacement key before revoking the old key to avoid interruption.