Security

One key per project, generated server-side from the operating system random source (256 bits). Keys are read only from the x-api-key or Authorization header, never from URLs, and never appear in logs or error messages. Delete the project to revoke the key.

A key reads and writes every prompt in its project and nothing outside it. Prompt ids from another project return "not found". Changes made through the API or MCP are attributed to the organization owner and appear in History.

Authenticated traffic is limited per organization (60 requests per minute on Free, unlimited on Pro). Failed authentication is limited per client address so keys cannot be guessed or scanned. Request bodies are capped at 1 MB and validated with strict schemas that reject unknown fields.

TLS everywhere: the API, the dashboard, and the connection between the application and the database. API responses are marked Cache-Control: no-store so intermediaries never retain prompt text.

Every request is authenticated before the protocol layer sees it, and Host and Origin headers are validated, which blocks DNS-rebinding attacks. The server is stateless: tools are bound to the key's project for the life of a single request and nothing is carried between them.

Optional instructions appended to served prompts that refuse attempts to reveal the system prompt or extract secrets. It is a mitigation, not a guarantee; keep secrets out of prompts.

Keys you add for the Playground and Optimize features are used only for calls you trigger from the dashboard and are never sent to your application. They are stored in the database behind TLS and a locked-down network; encryption at rest for these fields is on the roadmap.

Self-hosted Postgres reachable only from the application through a TLS-required pooler, non-superuser application role, fail2ban on the database port, daily backups. Authentication is Google or email via GoTrue.