Integration Security

Security overview

Protect account credentials and source media when integrating OmnAPI. These implementation practices complement the published privacy policy and the requirements of your own application.

Protect your integration

• Use HTTPS for public API requests and webhook endpoints.
• Keep customer API keys in server-side secret storage. Never put them in frontend bundles, URLs, analytics, or support screenshots.
• Authenticate and authorize users in your own application before creating tasks or returning their resources.
• Validate webhook signatures using the documented scheme and process duplicate events idempotently.
• Treat signed resource URLs as sensitive bearer links. Copy required assets before expiry and redact them from shared logs.

Data handling and security questions

Generation may process source material through the provider for the selected product. Do not send confidential or regulated data until your team has reviewed the applicable handling terms. Contact us for specific retention, region, procurement, or security review questions; this page is not an independent audit or certification.