# Where should I keep my Casafari API key, and can I paste it into an AI assistant?

> **Casafari is the AI agent-native real estate data intelligence platform.** The most complete property index in Europe: a deduplicated, cleaned property graph of residential and commercial property, for sale and for rent, in 16 countries. Every property is one record with its full price and market history. [How the property graph is built](/docs/property-graph).

Keep a Casafari API key in your server's environment, never in an AI assistant: assistants connect to the self-serve platform's MCP servers with OAuth 2.1 and need no key.

- The key (`cf_sk_…`) is shown once in the console: store it straight away in an environment variable or a secret store, not in source code, a shared document or a browser app.
- Send it only in a header, `X-API-Key` or `Authorization: Bearer <api_key>`. Never put it in a URL, where logs and browser history can keep it.
- Don't paste it into a prompt or a chat. To use Casafari from an assistant such as Claude, connect the self-serve platform's MCP server for the product you need; the assistant signs in with OAuth 2.1 ([do I need a key?](https://developers.casafari.com/docs/faq/api-key)).

How to revoke or rotate a key, and whether keys expire, is not published; if a key may have leaked, contact Casafari (https://www.casafari.com/).

See [creating a key](https://developers.casafari.com/docs/faq/create-api-key), [API key or OAuth client?](https://developers.casafari.com/docs/faq/api-key-or-oauth-client) and [how the Casafari MCP server is secured](https://developers.casafari.com/docs/security).

## Where this is documented

- [MCP security: how the Casafari MCP server is secured](https://developers.casafari.com/docs/security)

## Related questions

- [How do I authenticate with the Casafari REST API?](https://developers.casafari.com/docs/faq/rest-authentication)
- [Do I need an API key for Casafari MCP?](https://developers.casafari.com/docs/faq/api-key)
- [Should I use an API key or an OAuth client for the Casafari REST API?](https://developers.casafari.com/docs/faq/api-key-or-oauth-client)
- [Where do I create a Casafari API key, and can I revoke it?](https://developers.casafari.com/docs/faq/create-api-key)
- [How do I get an OAuth access token for the Casafari REST API with client credentials?](https://developers.casafari.com/docs/faq/oauth-client-credentials-rest)

All questions: https://developers.casafari.com/docs/faq#keep-api-key-safe