Skip to main content
  • Keep API keys in server-side secret stores, not browser bundles.
  • Rotate scoped keys per project or client.
  • Use mesh_test_ keys in development and mesh_live_ keys in production.
  • Pick the right privacy class per call. protected_provider_route for sensitive workloads on frontier models; private_gateway_route when you don’t want MESH-side operators or infrastructure to be able to inspect plaintext; confidential_runtime_route when no closed model provider should receive plaintext at all.
  • Monitor /v1/logs, /v1/usage, and receipts for unusual activity.
MESH returns receipt IDs and cost headers so operators can trace spend without logging prompts. The RequestLogRecord schema is metadata-only by construction — request and response bodies are never written to logs, traces, or analytics regardless of the privacy class.