API keys

• Keep OPTIMAI_API_KEY on a server or trusted agent host.
• Send it in the X-API-Key header; do not put it in browser bundles, public URLs, prompts, or logs.
• Rotate a key when a team member leaves, a key is exposed, or an application boundary changes.
• Use separate keys for separate environments or application boundaries. A sk_test_ key is a partner policy mode, not a standalone staging sandbox; it uses the same production infrastructure and account-level balance as a sk_live_ key.
• Test keys are only for active external partners and may expire or have lower rate and concurrency limits. Do not put a test key in a public client and do not treat its prefix as proof that it is isolated from production systems.

x402 wallet keys and payment context

• Treat X402_EVM_PAYER_PRIVATE_KEY and X402_SOLANA_PAYER_PRIVATE_KEY as real wallet secrets.
• Keep payer keys in a secret manager or controlled local environment. They are not OptimAI API keys or Coinbase facilitator keys.
• paymentContext can contain the original payment signature. Store it with the same care as a credential and pass it only to the worker that needs to poll or fetch the paid search.
• Never hard-code payTo, amount, asset, or network values; sign the exact payment requirement returned by the server.

BNB Agent wallets

• Use a dedicated buyer wallet for BSC mainnet ERC-8183 jobs.
• Never use the provider wallet as the buyer.
• Keep the private key and wallet password out of source code, .env commits, logs, prompts, and support chats.
• Verify chain ID 56, provider, contracts, policy, token, and budget before signing a transaction.

Content and result safety

• Show citations so users can inspect source material.
• Do not render untrusted source content as raw HTML.
• Keep user metadata minimal when creating searches.
• BNB Agent V1 result manifests are publicly retrievable. Never put confidential information in a job description.

Never share a seed phrase, private key, wallet password, or internal API key with support or another agent.