Protect a first upstream without skipping the safety boundaries

The short version

Start with one workspace, one application key, and one exact upstream host. That narrow setup is easier to understand, test, and revoke.

Begin with the account and workspace

Sign in with a verified account and confirm the dashboard shows the workspace you intend to configure. Workspace membership determines which configuration and activity you may see.

If no workspace appears, ask an Owner or Admin for a manual invitation link. Do not reuse another person’s session or request a database-side membership shortcut.

Verify the account email before live key creation.
Confirm the active workspace name before every setup change.
Use separate browser profiles when testing different workspace roles.

Approve the destination before traffic

Add the smallest hostname your application needs, such as api.example.com. Host entries do not include protocols, ports, paths, query strings, or credentials.

Use an explicit one-level wildcard only when subdomains genuinely vary. A wildcard such as *.example.com does not approve the parent domain or deeper descendants.

Private, local, metadata, reserved, unsafe-port, and overly broad public-suffix targets remain blocked even when a user attempts to configure them.

Create, copy, and isolate the key

Create a clearly named workspace key after email verification. The raw value is displayed once, so copy it directly into an approved secret manager rather than a ticket, document, or screenshot.

A ThrottleProxy key authenticates the request to ThrottleProxy. It is not an upstream provider credential and is stripped before forwarding.

Synchronize and verify deliberately

Use the workspace configuration sync after reviewed host changes. Start with a low-risk request that contains no customer data and confirm the response and workspace activity behave as expected.

The dashboard request timeline is currently a synthetic preview. Use safe status, timing, and correlation context rather than expecting a fully connected customer request inspector.

Before you move on

Verified account is signed into the intended workspace
Exact upstream host is approved
Application-specific key is stored outside the browser
Workspace configuration is synchronized
First request contains no customer secrets or sensitive payload
Billing and diagnostics boundaries are understood