Skip to content

docs: warn against exposing assistant API key client-side #6197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ethanpalm merged 4 commits into from
Jun 16, 2026
+6 −0
Merged

docs: warn against exposing assistant API key client-side #6197

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5cad527
docs: warn against exposing assistant API key client-side
mintlify[bot] Jun 16, 2026
e1de44e
docs: refine assistant API key security warning copy
mintlify[bot] Jun 16, 2026
009b6df
docs: move assistant API key warning to top of section
mintlify[bot] Jun 16, 2026
633b48e
Update api/introduction.mdx
ethanpalm Jun 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions api/introduction.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@

The Mintlify REST (Representational State Transfer) API enables you to programmatically interact with your documentation, trigger updates, embed AI-powered chat experiences, and export analytics data.

## Endpoints

Check warning on line 10 in api/introduction.mdx

View check run for this annotation

Mintlify / Mintlify Validation (mintlify) - vale-spellcheck

api/introduction.mdx#L10 

Use 'endpoints?' instead of 'Endpoints'.

- [Trigger update](/api/update/trigger): Trigger an update of your site when desired.
- [Get update status](/api/update/status): Get the status of an update and other details about your docs.
Expand Down Expand Up @@ -51,6 +51,12 @@

### Assistant API key

<Warning>
Do not directly embed the assistant API key in client-side code. Any visitor who extracts the key can send requests on your behalf, consuming credits and potentially triggering overage charges.

For production deployments, proxy assistant API requests through your own backend and store the key as a server-side environment variable. Routing requests through a proxy also lets you add rate limiting, authentication, and bot protection to prevent abuse.
</Warning>

Use the assistant API key to authenticate requests to [Create assistant message](/api/assistant/create-assistant-message-v2), [Search documentation](/api/assistant/search), and [Get page content](/api/assistant/get-page-content) endpoints.

Assistant API keys begin with the `mint_dsc_` prefix.
Expand Down
Loading