Suno API key security
A key is a bearer token: anyone who has it can spend your balance. Treat it like a payment credential.
Where the key lives
Server-side environment variables or a secret manager only. Never put it in a browser bundle, mobile app, public repository or support ticket. Use separate keys per environment and per service so one leak does not expose everything.
Rotation without downtime
- Create a new key and deploy it alongside the old one.
- Verify traffic on the new key.
- Revoke the old key.
- Check usage and error rates for the next hour.
If a key leaks
Revoke first, then investigate: usage spikes, unknown IPs, unusual endpoints. Rotate, redeploy, and remove the secret from logs and history. A leaked key is an incident even if the spend looks small.
常见问题 / FAQ
Can I call the API from a browser?
No. A browser key is visible to every visitor; proxy through your server.
One key per environment?
Yes. Separate development, staging and production keys, and rotate on staff changes.
How often should I rotate?
On a schedule you can actually follow, and immediately after any suspected exposure.
注册只需要邮箱，一次生成 0.6 元出 2 首，MP3 与 WAV 下载不限次。