Use a Project-M API key
Every application calling Project-M LLM should send a Project-M API key in the Authorization header.
Header
Authorization: Bearer YOUR_PROJECT_M_API_KEY Content-Type: application/json
Keep your API key on the server side. Do not expose private API keys in browser JavaScript, mobile app bundles, public repositories, or frontend environment files.
Recommended backend pattern
Your app frontend should call your own backend. Your backend should call Project-M using the API key. This prevents users from extracting the key from the browser.