Skip to main content
An API key or signing secret never leaves a client except on the wire.

Never in an error

No message, stack, property or cause holds a key.

Never in a log

Response hooks and log lines get no header, query or body.

Never in a dump

Inspecting, printing or serializing a client shows no key.

Never to another site

Redirects are never followed, so a key never reaches another origin.
The keys live in the request function’s closure, never in a property: inspect(), JSON.stringify() and String() of a client show none, and the SDK never writes to the console.
One exception is your own. A custom fetch whose errors carry the request’s headers puts the key in SiteUnreachable’s cause. Keep your fetch’s errors free of headers.
Keep keys and signing secrets on servers. A browser bundle publishes them.

Next: Agent Skills

The Agent Skill each SDK ships, installed with one command.