Skip to main content
Do not expose a secret API key in browser JavaScript or a mobile binary. Send requests from your server and apply user-level authorization there.
Use a secret manager or server-side environment variable. For local tools, use their encrypted credential store or a user-level configuration excluded from version control.
Delete the key immediately under Console > API Keys, create a new one, update the affected environments, and review request logs for unexpected use.
Prefer separate development, staging, production, and tool-specific keys. This limits blast radius and makes usage attribution easier.
Pass a webhook_secret, verify the X-Shim-Signature over the raw request body, reject old timestamps, and deduplicate final-state deliveries.
No. Video reference inputs must be publicly reachable http or https URLs. Private, loopback, local, and reserved network destinations are rejected.