Your API key grants the access currently approved for your account. Treat it as a secret even if the account has no data grants today.
Store and use credentials privately
Use a secret manager or private server environment.
Send REST keys in the documented header to https://api.oddswire.io.
Keep reusable keys out of URLs, public browser code, repositories, screenshots, chat, email and article comments.
Use your own workspace login; do not share passwords or session tokens.
Copied playground snippets can contain your key. Remove it before sharing code. Do not send both a data key and a workspace session token.
Share diagnostics safely
Support can investigate using the operation, request ID, approximate UTC time, namespace/source and redacted error text. Remove Authorization and X-API-Key headers, cookies, verification codes, webhook secrets and unrelated private data.
Shared devices and connected apps
Sign out when finished on a shared device. Review the host and requested consent before connecting an MCP app. Only approve calls you intend to run; read-only data tools can still use credits.
If a key may have leaked, revoke or rotate it from API keys, update your integrations and contact support without sending the raw key.