Guides
Going to production
Name your app, keep a ceiling on every key, and make cost questions easy to answer.
On this page
App attribution
Optional headers that put your app on the public rankings and model pages.
HTTP-Referer: https://your-app.example
X-Title: Your AppReferer is accepted when HTTP-Referer is absent. Only the origin of the referer is ever shown publicly, never its path or query. Both values also appear in your own request log.
Best practices
- Use one key per app or environment, each with its own spend limit, so a leak or a bug has a ceiling.
- Add an IP allowlist for keys used from fixed servers, and an expiry for temporary keys.
- Restrict production keys to the models you actually use, so a typo cannot route to a much pricier model.
- Log
x-ditfa-generation-idwith your own request ids; it makes cost questions and support tickets quick to answer. - Check
GET /creditsfrom a cron job or set a low-balance alert so production never hitsinsufficient_credits.