---
title: API Key Settings
description: Configure ECMAScript version, Jodit version, referrers, and language for your Cloud API key.
keywords: jodit cloud, settings, ecmascript, referrers, language, configuration
---

# API Key Settings

In your account dashboard, you can configure the following parameters for your API key.

## ECMAScript Version

Choose the JavaScript version to be loaded:

- **auto** - Automatic detection based on user's browser
- **es5** - Compatibility with older browsers (IE11+)
- **es2015** - Modern browsers with ES6 support
- **es2018** - Browsers with async/await support
- **es2021** - Latest browsers

## Jodit Version

- **latest** - Always load the latest version (recommended)
- **Specific version** - Lock to a specific version (e.g., "4.0.1")

## Minification

- **Enabled** - Load minified files (smaller size, recommended for production)
- **Disabled** - Load unminified files (useful for development and debugging)

## Allowed Domains (Referrers)

**Referrers protect your API key from unauthorized use.**

### What are Referrers?

Referrers specify which domains are authorized to use your API key. When a browser requests the Jodit Cloud script, our system checks the HTTP referrer header to verify that the request comes from an allowed domain.

### Why Configure Referrers Correctly?

- Without proper referrer settings, anyone could copy your script URL and use your API key on their website
- Unauthorized usage counts against your license limits and could affect performance
- With referrers configured, only websites you own or trust can load the editor using your API key
- Opening the script URL directly in a browser, or requesting it from an unauthorized domain, returns no content

### How Referrer Protection Works

1. When a webpage loads the Jodit Cloud script, the browser sends a referrer header
2. Our system checks if the referrer matches your configured allowed domains
3. If the referrer is authorized, the script loads
4. If the referrer is not authorized or missing, the request is blocked (returns 403 Forbidden)
5. Direct URL access (no referrer) is also blocked

### Referrer Configuration Examples

- **localhost** - Allowed by default for development and testing
- **example.com** - Allow only the exact domain
- **\*.example.com** - Allow all subdomains (wildcard pattern)
- **subdomain.example.com** - Allow specific subdomain only

### Best Practices

- **Always specify your production domains** - Don't rely on default settings
- **Use wildcards carefully** - `*.example.com` allows ANY subdomain
- **Include both www and non-www versions** if needed
- **Test thoroughly** - Verify your editor loads correctly from all intended domains
- **Keep the list minimal** - Only include domains you actually use

For more details on security, see [Security](./security.md).

## Language Optimization

Jodit Cloud controls which language files are loaded, which keeps the bundle small.

### Language Loading Options

- **Full (Default)** - All language packages are disabled in the build, so the bundle is as small as possible. The editor uses the English interface only.

- **Auto** - Detects the user's browser language and loads only the matching language file. The interface follows the user's language and the bundle stays small.

- **Specific Language** - Load only a particular language (e.g., Russian, German, Japanese). Use this when you know your audience uses one language.

### How Auto Language Detection Works

1. User visits your website with Jodit Cloud editor
2. Browser language is detected automatically (e.g., `navigator.language`)
3. Only the matching language pack is loaded dynamically
4. Interface appears in the user's native language
5. Fallback to English if the user's language is not available

### Available Languages

Arabic, Czech, German, English, Spanish, Finnish, French, Hebrew, Hungarian, Indonesian, Italian, Japanese, Korean, Dutch, Polish, Portuguese (Brazil), Russian, Turkish, Chinese (Simplified), Chinese (Traditional), Ukrainian, Norwegian

### When to Use Each Option

- **Full** - Single-language sites (English only) or when you handle translations separately
- **Auto** - International websites with global audience
- **Specific** - Target audience primarily uses one non-English language