Security

API Key Management

Your API key is a secret credential with full access to your GuidedMind project. Treat it like a database password.

Correct Pattern

# ✅ Read from environment — the SDK does this automatically
from guidedmind import Client
 
client = Client()  # reads GUIDEDMIND_API_KEY
 
# ✅ Explicit env lookup — acceptable
import os
client = Client(api_key=os.environ["GUIDEDMIND_API_KEY"])
 
# ❌ Never do this
client = Client(api_key="gm_live_abc123...")

Using python-dotenv (Development Only)

from dotenv import load_dotenv
load_dotenv()  # loads .env into os.environ
 
from guidedmind import Client
client = Client()

# .env — never commit this file
GUIDEDMIND_API_KEY=gm_live_your_key_here

# .gitignore
.env
.env.local
.env.*.local

Built-in Security Features

The SDK enforces several security properties automatically:

• Key format validation — The client rejects malformed keys at initialisation time, before any network request is made.
• Key redaction in logs — Any log output or error message that would contain your API key is automatically redacted to gm_live_***.
• HTTPS enforcement — The client raises ConfigurationError if base_url uses http:// instead of https://. TLS 1.2+ is required.
• Input validation — All parameters are validated by Pydantic before the request is sent, preventing malformed data from reaching the API.
• No sensitive data in errors — Exception messages are sanitised — they never include request bodies or full response payloads that might contain user data.

Secrets Managers

AWS Secrets Manager

import boto3
import json
from guidedmind import Client
 
def get_client() -> Client:
    sm = boto3.client("secretsmanager", region_name="us-east-1")
    secret = sm.get_secret_value(SecretId="guidedmind/api-key")
    key = json.loads(secret["SecretString"])["api_key"]
    return Client(api_key=key)

HashiCorp Vault

import hvac
from guidedmind import Client
 
def get_client() -> Client:
    vault = hvac.Client(url="https://vault.example.com")
    secret = vault.secrets.kv.v2.read_secret_version(path="guidedmind")
    key = secret["data"]["data"]["api_key"]
    return Client(api_key=key)

Network Security

If your infrastructure requires outbound traffic restrictions, allow the following:

The SDK does not make connections to any other external hosts.