---
title: Cloud Security
description: How Jodit Cloud protects your API key with referrer-based security.
keywords: jodit cloud, security, api key, referrer, protection
---

# Security

## API Key Protection

- Never publish your API key in public repositories
- Configure referrer settings: they are the primary defense against unauthorized usage
- Regenerate the key immediately if it is compromised
- Monitor usage for unexpected traffic

## Referrer-Based Security System

Jodit Cloud checks the HTTP referrer header on every request to protect your API key:

- The script URL cannot be opened directly in a browser
- Every request must come from an authorized domain
- Unauthorized requests receive a 403 Forbidden response

Even if someone discovers your API key, they cannot use it from a domain that is not on your allowed list.

## Why This Matters

Without referrer protection, anyone with your API key could use your quota and bandwidth. That unauthorized usage would count against your license limits, add unexpected load from other domains, and could lead to overage charges.

With the referrer system, your API key works only on your authorized domains.

To configure allowed domains, see the [Allowed Domains (Referrers)](./settings.md#allowed-domains-referrers) section in API Key Settings.