Security

The API is designed to be safe by default: TLS-only, protected keys, rate-limited endpoints, and no source identifiers leaked to clients. This page covers the practices you should follow.

What the API does

• TLS required — plaintext HTTP is rejected.
• Protected keys — keys are not stored in plaintext and cannot be recovered if lost.
• Revocable — any key can be revoked instantly from the admin panel.
• Proxied images — image URLs are proxied through Deeline and cannot be traced to their source.
• Rate limited — per key, per IP, per route — reduces abuse and DoS risk.
• Content-type and payload guards — oversized requests and wrong content types are rejected at the edge.

What you should do

• Store keys in environment variables, never in code or client bundles.
• Never commit keys to git — use `.env` files, `.gitignore` them.
• Use HTTPS on your server — the API will reject plaintext but your own server should also use TLS.
• Rotate keys periodically — every 90 days, or immediately on any sign of compromise.
• Monitor usage — check last-used and request counts; unexpected spikes mean a leak.
• Log requests — on your side, so you can trace anomalies.

What not to do

• Do not embed the key in mobile apps, single-page apps, or Chrome extensions — anything the user can inspect.
• Do not share one key across multiple integrators — one key per integration.
• Do not modify image URLs — use them as returned by the API. Do not strip the proxy path or alter the token.
• Do not ignore 429s — repeated violations may lead to suspension.

If a key is compromised

1. Revoke the key immediately from the admin panel.
2. Issue a new key and rotate it in your integration.
3. Check API logs for unexpected usage from the compromised key.
4. If the key was ever exposed publicly, treat the exposure as active — act now, not later.

Report a vulnerability

If you find a security issue in the API, contact us privately before disclosing publicly. We respond to security reports within 48 hours.