> ## Documentation Index
> Fetch the complete documentation index at: https://docs.meshrouter.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Security best practices

> Protect MESH API keys and private routing material.

* Keep API keys in server-side secret stores, not browser bundles.
* Rotate scoped keys per project or client.
* Use `mesh_test_` keys in development and `mesh_live_` keys in production.
* Pick the right [privacy class](/privacy/mesh) per call. `protected_provider_route` for
  sensitive workloads on frontier models; `private_gateway_route` when you don't want MESH-side
  operators or infrastructure to be able to inspect plaintext; `confidential_runtime_route` when
  no closed model provider should receive plaintext at all.
* Monitor `/v1/logs`, `/v1/usage`, and receipts for unusual activity.

MESH returns receipt IDs and cost headers so operators can trace spend without logging prompts.
The `RequestLogRecord` schema is metadata-only by construction — request and response bodies are
never written to logs, traces, or analytics regardless of the privacy class.