> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quotamint.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security checklist

> Protect credentials, customer data, and balances

Before production traffic, verify each item below.

## Credentials

* Store project keys in a server-side secret manager.
* Use separate test and live secrets.
* Rotate keys by creating the replacement before revoking the old key.
* Never log `Authorization` headers, request bodies, or metadata.

## Request handling

* Call QuotaMint from your backend.
* Use `consume` as the authoritative decision.
* Use a stable idempotency key for every billable operation.
* Retry `500`, `503`, network ambiguity, and `429` with the original key and appropriate delay.
* Treat denial reasons as normal product outcomes, not exceptional server failures.

## Data isolation

Projects are the tenant boundary. Use one project per environment when balances must not mix. A public request can never choose a project or environment in its body; the API key establishes them.

## Operational stop switches

A disabled project returns `403 project_disabled`. Build a clear fallback path in your product and alert on repeated `503` responses: a disabled or unavailable runtime does not allow traffic.