Protect your account and keys

Everyday precautions

• Use a unique password for your Guangji API account.
• Create separate keys for applications, with suitable limits and expiry dates.
• Keep keys out of public repositories, browser frontend code, screenshots and chat messages.
• Enter keys only in trusted clients. Review unfamiliar extensions and forwarding services carefully.

Two-factor authentication

If your profile offers 2FA, follow its instructions to connect an authenticator. Store recovery codes securely. If session management is available, review unfamiliar devices and revoke suspicious sessions.

If a key may have leaked

1. Immediately disable or delete it on the API keys page.
2. Review usage logs and record unexpected request times, models and costs.
3. Create a new key and update your applications.
4. Remove exposed credentials from files, logs and screenshots. Do not reuse the old key even after removing those files.
5. Contact support with redacted details about unexplained usage.

Changing your account password does not replace revoking a leaked API key. Handle the key separately.

Account access tokens are different

The access token in your profile is for account management APIs. Do not use it as a model API key or send it to support.

Information you can share with support

Provide your user ID, key name, request ID, time, model and error message. Redact keys, passwords, verification codes and payment credentials from screenshots.