Can I call SnapGen directly from browser code?
Can I call SnapGen directly from browser code?
Do not expose a secret API key in browser JavaScript or a mobile binary.
Send requests from your server and apply user-level authorization there.
Where should I store the API key?
Where should I store the API key?
Use a secret manager or server-side environment variable. For local tools,
use their encrypted credential store or a user-level configuration excluded
from version control.
What should I do if a key is exposed?
What should I do if a key is exposed?
Delete the key immediately under Console > API Keys, create a new one,
update the affected environments, and review request logs for unexpected use.
How do I secure a webhook endpoint?
How do I secure a webhook endpoint?
Pass a
webhook_secret, verify the X-Shim-Signature over the raw request
body, reject old timestamps, and deduplicate final-state deliveries.Can reference images use private URLs?
Can reference images use private URLs?
No. Video reference inputs must be publicly reachable
http or https
URLs. Private, loopback, local, and reserved network destinations are
rejected.