> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aiid.edu.kg/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and Security

> Protect your API tokens and data

## Token Authentication

Outbound API uses the standard Bearer Token mechanism for authentication.

### Header Format

```text theme={null}
Authorization: Bearer YOUR_API_KEY
```

## Token Security Standards

### 1. Principle of Least Privilege

If you distribute the API Key to external partners, restrict the following for that Key in the console:

* **Model Scope**: Only allow calls to specific models.
* **Expiration Time**: Set short-term expiration to reduce risk.
* **IP Whitelist**: Restrict the IP addresses of the caller.

### 2. No Client-Side Hardcoding

Never hard-code the `sk-` token in frontend JavaScript or mobile app code. All API calls should be proxied through a backend server, or use our secure distribution system to generate short-lived tokens.

### 3. Data Privacy

We do not store your conversation content. API acts only as a high-performance relay node; conversation content flows through memory and is passed directly to the underlying service provider.

## Monitoring and Auditing

You can monitor the details of each API call in real time on the "Logs" page in the console. If you have any security questions, please email [support@aiid.edu.kg](mailto:support@aiid.edu.kg).