API keys
Issue narrowly scoped personal keys, store their secrets safely, and revoke access immediately.
Create and manage keys in Dashboard → API keys. A key belongs to one Better Auth user and is intended for server-side use.
Use the secret as a bearer token
Pass the secret in the Authorization header:
Authorization: Bearer ot_your_secretKeep the secret in your deployment environment. Do not embed it in a browser bundle, mobile app, client-side Playground script, or source repository.
Limit where a key can be used
When creating or updating a key, you can limit it to a set of public model IDs and optional network ranges. A restricted key rejects a request for a model outside its allow-list before a reservation is created.
Revoke rather than rotate in place
Revocation takes effect immediately for new API requests. Create a replacement key, deploy the new secret, verify it, then revoke the old one. This gives you a clear audit boundary without a period where both environments silently share the same credential.
The secret is shown once
Store it in your secret manager when it is created. The dashboard keeps the label, prefix, scope, and status, but not a recoverable copy of the secret.