Key security

An API key acts on behalf of your account. Anyone who holds it can do what you do in the app, including spending your credits. Treat it like a password.

What a key allows

What it sees	your generations, your clips, your credits, your brand templates
What it does not see	anything that belongs to another account
What it can do	everything you can do from the app, including spending credits
Its lifetime	unlimited, until you revoke it
Its rights	full: there is no read-only key

A key does not expire on its own and cannot be restricted. Review your keys from time to time and revoke the ones you no longer use.

What ClipHeat keeps

ClipHeat does not store the key in clear, only a fingerprint that lets it recognise the key. Nobody can show it to you again: that is why it is displayed only once, when it is created.

Three ways to lose it

1. Your terminal history. A curl -H "X-API-Key: ch_…" command stays in the shell history. Use an environment variable:

   export CLIPHEAT_CLE=ch_your_key
   curl https://clipheat.app/api/credits \
     -H "X-API-Key: $CLIPHEAT_CLE"

2. A code repository or continuous integration logs. A key written in a versioned file is published with it. Use the secrets manager of your forge or host.

3. The browser. Do not call the API from a web page’s JavaScript: the key would be readable by any visitor. Call it from a server or your workstation.

If a key has leaked

1. Revoke it: Settings → API keys. It is refused from the moment it is revoked.
2. Create a new one and replace the old one wherever it was used.

Nothing else is needed: a revoked key no longer gives any access.

Tip

One key per use (a script, an integration, an assistant): if in doubt, you revoke that one without cutting off the others.

Always over HTTPS

The key travels in a request header. Always call https://clipheat.app: over HTTPS, it is encrypted in transit.