Operate
Security
CostIQ keeps customer access separate from provider and administrative credentials. Your application still owns safe key storage and responsible request handling.
Credential handling
Issue a separate key for every person, service, and environment.
Store keys in a password manager or application secret store.
Inject keys at runtime; keep them out of source, images, logs, and analytics.
Use keys only from trusted server-side or local processes—not browser bundles.
Public API boundary
Customer credentials reach only model discovery and chat completions. Gateway administration, key management, provider addresses, and upstream credentials are not part of the public API.
Data handling
Prompt and output logging is disabled by default in the CostIQ gateway. CostIQ records usage metadata needed to operate the service, including request and token counts, latency, errors, and estimated cost.
Routing policy
Clients request stable CostIQ aliases rather than provider model IDs. Automatic fallback is disabled, and attempts to override routing, retry, provider, identity, tag, or metadata controls fail closed.
Rotate or revoke a key
Contact your CostIQ administrator immediately if a key may be exposed. A replacement key can be issued, tested, and installed before the previous credential is revoked. Revoked keys return 401.