Security
Secure API Keys
Secure API Keys
- Never commit API keys to version control
- Use environment variables
- Rotate keys regularly
- Use separate keys for dev/staging/production
Backend Only
Backend Only
Never expose API keys in client-side code:
- ❌ Browser JavaScript
- ❌ Mobile apps
- ❌ Public repositories
- ✅ Backend servers
- ✅ Serverless functions
Input Validation
Input Validation
Always validate user input:
Performance
Use Async for Concurrency
Use Async for Concurrency
Process multiple requests in parallel:
Stream When Possible
Stream When Possible
Use streaming for better perceived performance:
Cache Responses
Cache Responses
Cache common queries to save costs:
Cost Optimization
Choose the Right Model
Choose the Right Model
Use cheaper models when appropriate:
- Simple tasks:
gpt-4.1-nano,claude-3.5-haiku - Complex reasoning:
gpt-5.1,claude-sonnet-4.5,o3 - Code:
claude-sonnet-4.5,gpt-5.1 - Fast & affordable:
gpt-5.1-mini,gpt-4.2-mini
Optimize Prompts
Optimize Prompts
Shorter, more specific prompts cost less:
Limit Output Length
Limit Output Length
Set
max_tokens to avoid excessive output:Monitor Usage
Monitor Usage
Track costs in real-time:
- Check Dashboard regularly
- Set up billing alerts
- Review usage patterns
- Identify optimization opportunities
Error Handling
Implement Retries
Implement Retries
Always retry transient errors:
Graceful Degradation
Graceful Degradation
Have fallbacks ready:
Log Errors
Log Errors
Track errors for debugging:
Production Checklist
Security
- ✅ API keys in environment variables
- ✅ No keys in client-side code
- ✅ Input validation
- ✅ Rate limiting on your API
Performance
- ✅ Async/concurrent requests
- ✅ Streaming enabled where appropriate
- ✅ Response caching
- ✅ Timeouts configured