Secure API integration

Put a server between users and project keys

Project keys grant project-level access; they do not express your application’s per-user permissions. Validate ownership before forwarding IDs or bytes. Add request limits, upload limits and authentication to your own endpoints.

Keep keys out of browser/mobile bundles, NEXT_PUBLIC_* variables, query strings, analytics and source control. The official SDKs are server clients. Use HTTPS outside local development.

Store and rotate credentials

Inject keys through protected server configuration or a secret manager. Use separate projects/keys for environments. Copy new keys once, update your server configuration, verify context and then revoke the old key through the Customer portal. Do not assume the API provides scoped read-only keys unless the contract says so.

Use X-API-Key for media integration. Customer Bearer tokens are used for project and key management; do not send both credentials in one request. Disable automatic cross-origin redirects for authenticated requests.

Handle input and metadata deliberately

Enforce product-specific file sizes, types and access rules before forwarding uploads. Filenames are display metadata, not filesystem paths. If your application accepts remote source URLs, limit who may supply them and use the configured source policy; do not rely on a URL’s extension as proof of content.

Image originals retain their original bytes and may contain EXIF, location or other metadata. Generated image derivatives strip metadata. Do not distribute an original when your privacy requirement depends on stripping it.

Generated QR content and barcodes can encode sensitive identifiers. The code API renders that content; authorization belongs at the destination or in your application. Test any SVG handling in your own delivery context.

Private delivery and retention

Media download endpoints require project authentication. This contract has no anonymous CDN or customer signed delivery URL. Stream or serve bytes through your own authorized endpoint without exposing the key. See output retention and deletion.

Do not log raw media, base64 pages, full QR payloads or credentials. Establish your own retention policy; account deletion is not immediate physical erasure of all media or audit records. Product-level security scope is described on Security & trust.