- Keep API keys in server-side secret stores, not browser bundles.
- Rotate scoped keys per project or client.
- Use
mesh_test_keys in development andmesh_live_keys in production. - Pick the right privacy class per call.
protected_provider_routefor sensitive workloads on frontier models;private_gateway_routewhen you don’t want MESH-side operators or infrastructure to be able to inspect plaintext;confidential_runtime_routewhen no closed model provider should receive plaintext at all. - Monitor
/v1/logs,/v1/usage, and receipts for unusual activity.
RequestLogRecord schema is metadata-only by construction — request and response bodies are
never written to logs, traces, or analytics regardless of the privacy class.