> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fetchski-attract.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Keeping keys secret

> Where a key never shows up, and the one place it does.

An API key or signing secret never leaves a client except on the wire.

> [card] Never in an error
>
> No message, stack, property or cause holds a key.

> [card] Never in a log
>
> Response hooks and log lines get no header, query or body.

> [card] Never in a dump
>
> Inspecting, printing or serializing a client shows no key.

> [card] Never to another site
>
> Redirects are never followed, so a key never reaches another origin.

The keys live in the request function's closure, never in a property: `inspect()`, `JSON.stringify()`
and `String()` of a client show none, and the SDK never writes to the console.

> [!WARNING]
>
> **One exception is your own.** A custom `fetch` whose errors carry the request's headers puts the key
> in `SiteUnreachable`'s cause. Keep your fetch's errors free of headers.

> [!CAUTION]
>
> Keep keys and signing secrets on servers. A browser bundle publishes them.

> [card] [Next: Agent Skills](https://docs.fetchski-attract.com/agent-skills.md)
>
> The Agent Skill each SDK ships, installed with one command.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.