Keep your API keys safe

An API key works like a password that can spend money or act on your account. Treat it like one.

Where Bricklayer keeps your keys

Keys you enter in Bricklayer Editor are stored on your computer, in a file in your user profile that only your Windows account can read. Each key is sent only to the provider it belongs to. Bricklayer never receives a copy.

To remove a stored key, sign out of that provider in the Editor.

Never put a key in any of these

• An AI chat, including Bricklayer's, or any message to Brick.
• A help-forum thread, Discord message, or screenshot.
• A script in your game, or any file in your project folder.
• A Git commit, even in a private repository.

If a key leaks

Act right away. It takes two minutes.

1. Revoke the key on the provider's website. For OpenRouter, that is openrouter.ai/keys. For a Roblox Open Cloud key, use Creator Dashboard → API Keys.
2. Create a new key and enter it in Bricklayer (Ctrl+I → your provider).
3. Check usage on the provider's dashboard for anything you did not do.
4. Remove the leaked copy wherever it was posted. On this help forum, you can delete your own message, or ask in the thread for the team to remove it.

Deleting a message is not enough on its own. Someone may already have copied the key. Revoking it is what makes it useless.

Roblox Open Cloud keys

These can publish and read data for your experiences, so they deserve extra care: restrict them to a single test experience, give them only the permissions they need, and use a short expiry. Connect Roblox Open Cloud safely walks through it.