> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pinakelai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Protecting API keys, calling the API from servers only, transport security, and what to do if a key leaks.

## Protect your keys

An API key is a password for your organisation's access and quota.

* **Keep keys on servers.** Never put a key in browser JavaScript, a mobile app, a desktop app you distribute, or anything else a user can inspect.
* **Store keys in a secret manager**, or at least in environment variables, never in source code. Add a secret scanner to your repositories and CI.
* **Never send a key in a URL.** The API rejects keys in the query string with 401, because URLs leak into logs, browser history and analytics tools.
* **Use one key per service and environment**: production, staging and CI each get their own, and only production uses a `pk_live_` key. One leak then affects one system, and the usage figures tell you which system made which calls.
* **Keep keys out of your logs.** Log the `X-Request-Id` of a response, not the request headers.

## Call the API from your servers

The API accepts browser requests only from this documentation site, `https://docs.pinakelai.com`, for the playground. Browser code on your own domains is refused by the browser's CORS checks. This is deliberate: a key in browser code is exposed to every user. Call the API from your backend and pass the results to your front end.

## Transport

The API is served over HTTPS only, with HTTP Strict Transport Security. Keep certificate verification switched on in your HTTP client; never disable it to work around a proxy.

## The API is read-only

No endpoint changes data. `POST /v1/trademarks/batch` uses `POST` only to carry a list of ids. A leaked key exposes data you are entitled to and consumes your quota; it cannot alter anything.

## Brute-force protection

Requests with unknown keys are counted per IP address. After 20 within a minute, that address gets 401 with a `Retry-After` header for 5 minutes, even with a valid key, unless that key was used successfully within the last minute. If several systems share one egress address, one misconfigured system can lock out the others: fix wrong keys rather than retrying them.

## If a key leaks

1. **Rotate it** in the customer portal at [portal.pinakelai.com](https://portal.pinakelai.com). The old key stops working within about a minute. Deploy the new key.
2. **Check your usage** in the portal or with [`GET /v1/usage`](https://docs.pinakelai.com/api-reference/account/usage) for calls you did not make.
3. **Tell us** at [support@pinakelai.com](mailto:support@pinakelai.com) with the key's name (never the key itself) and the time range, so we can review the requests made with it.

## Reporting a vulnerability

If you find a security problem in the API or this site, email [support@pinakelai.com](mailto:support@pinakelai.com) with the subject "Security". Please do not test it against other customers' data or degrade the service while you investigate.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.