Practical guides
Step-by-step workflows, reusable briefs, and agent guardrails
Manage Keys, Quotas, and Fallbacks Before Running Models or Workflows
Keep API keys, environment variables, credit usage, and failure states explicit; never commit secrets to frontend code or public repos.
Audit environment variable usage and API calls in this project: 1) confirm no private API keys are exposed to the client bundle; 2) confirm external requests set timeouts and clear error messages; 3) list required environment variable names without printing secret values.
Any key placed in browser code, screenshots, or a public Git repo is exposed. Use server environment variables or Workspace model credentials, and verify .gitignore before committing.
- Never paste real API keys into client components, READMEs, or screenshots
- Revoke and rotate any key immediately if exposure is suspected
- Separate test credentials from production permissions
What to keepClient code, screenshots, and Git history contain no live keys.
Whether generating images, processing long documents, or running a multi-step workflow, test one small sample to verify format, latency, and credit cost before scaling up.
What to keepOne minimal sample run confirmed latency and credit usage before batching.
Distinguish network timeouts, invalid parameters, insufficient credits, and upstream rate limits. Avoid rapid blind retries that can duplicate charges or trigger stricter throttling.
What to keepFailures can be traced through status, error reason, and ledger records.