Private Keys

Overview

Secret API keys (sk_live_...) must never be exposed in client-side code, public GitHub repositories, or browser network requests.

Strict Server-Side Isolation

• Never prefix secret keys with NEXT_PUBLIC_, VITE_, or REACT_APP_.

• Use serverless secrets managers (AWS Secrets Manager, Doppler, Vault, Vercel Environment Variables).

Safe Usage in Next.js & Node.js

// app/api/admin/reindex/route.ts (Server Route Handler Only)
import { NextResponse } from "next/server";
export async function POST(req: Request) {
  const secretKey = process.env.ASIYST_API_TOKEN; // Server-only variable
  const response = await fetch("https://asiyst.com/api/v1/projects/proj_123/knowledge/reindex", {
    method: "POST",
    headers: {
      "Authorization": Bearer ${secretKey},
      "Content-Type": "application/json",
    },
  });
  const data = await response.json();
  return NextResponse.json(data);
}