Where does a request go?
Your application sends a request to AIAPI. The gateway checks access and applicable limits, routes the request to the configured upstream service, and returns its response. Usage is recorded for accounting and operation.
AIAPI is an independent gateway service. A provider name in the catalog does not imply an official partnership, exclusive representation or identical conditions across models.
Protect access at the application boundary
Use a separate key for each application, keep it on your server and configure the available limits. Revoke a compromised key and inspect usage before issuing a replacement.
- Do not put a secret key in frontend code, a public repository or a shared screenshot.
- Give users access to your backend, not to your unrestricted gateway key.
- Set output limits, timeouts and bounded retries; watch for repeated charges.
Before sending sensitive data
Do not assume zero retention, a specific processing country or training exclusion. Upstream processing depends on the selected model, route and applicable provider conditions. Ask us to clarify your intended use before sending regulated or confidential data.
This page is not a certification, penetration-test report, uptime guarantee or service-level agreement. Any special obligations must be agreed separately in writing.
Report a concern responsibly
Send a minimal, non-destructive reproduction to [email protected]. Do not access another person’s data, disrupt the service or publish usable credentials. Do not assume a bug-bounty reward is offered.