Where should I keep my Casafari API key, and can I paste it into an AI assistant?

Keep a Casafari API key in your server's environment, never in an AI assistant: assistants connect to the self-serve platform's MCP servers with OAuth 2.1 and need no key.

• The key (cf_sk_…) is shown once in the console: store it straight away in an environment variable or a secret store, not in source code, a shared document or a browser app.
• Send it only in a header, X-API-Key or Authorization: Bearer <api_key>. Never put it in a URL, where logs and browser history can keep it.
• Don't paste it into a prompt or a chat. To use Casafari from an assistant such as Claude, connect the self-serve platform's MCP server for the product you need; the assistant signs in with OAuth 2.1 (do I need a key?).

How to revoke or rotate a key, and whether keys expire, is not published; if a key may have leaked, contact Casafari (https://www.casafari.com/).

See creating a key, API key or OAuth client? and how the Casafari MCP server is secured.