Identify the process sending the request before configuring credentials. This shared guide covers runtime and dependencies without putting secrets into AI conversations.
- 1. Find executorLocal, container or remote
- 2. Prepare API keyAPI product credential
- 3. Inject variablesKeep shared files clean
- 4. Check presenceNever print values
1. Open the API console
Use your own API key and check balance and attempt budget. This is not a model key or proxy password. Never send a credential-bearing screenshot to chat or support.
2. Configure the actual runtime
These commands affect the current terminal and processes launched from it. Configure it before launching a CLI. Check editors, containers and remote services separately.
Windows PowerShell
$secret = Read-Host "Cloudbypass API key" -AsSecureString
$env:CLOUDBYPASS_APIKEY = [System.Net.NetworkCredential]::new("", $secret).Password
$env:TARGET_URL = "https://example.com/"
python -c "import os; print('Key configured:', bool(os.getenv('CLOUDBYPASS_APIKEY')))"macOS / Linux Bash
read -r -s -p "Cloudbypass API key: " CLOUDBYPASS_APIKEY
echo
export CLOUDBYPASS_APIKEY
export TARGET_URL="https://example.com/"
python3 -c "import os; print('Key configured:', bool(os.getenv('CLOUDBYPASS_APIKEY')))"3. Use the project Python environment
Reuse your project environment. In a new folder, create a virtual environment and install requests with the same interpreter. These commands do not call the Cloudbypass API.
python -m venv .venv
.\.venv\Scripts\python.exe -m pip install requestspython3 -m venv .venv
./.venv/bin/python -m pip install requests4. Keep secrets out of repositories and logs
- Keep only variable names/placeholders in shared files and ignore local .env files.
- Do not dump environments or full headers, or embed keys in URLs.
- Revoke or rotate an exposed key before cleaning logs/history; deleting one visible line is not enough.
- Use server-side n8n credentials or Dify Secret variables, not public user inputs.
Frequently asked questions
What if the check returns false?
Check the terminal, interpreter and process. An app started earlier does not automatically receive new variables.
Can browser JavaScript call directly?
Do not expose the key in browser code. Let your backend read it and return only required business data.
Where do proxy credentials belong?
Configure them securely when the chosen API version requires them. A system proxy is not x-cb-proxy.