Key Handling
- Store keys only on servers, secret managers, or trusted workflow tools.
- Do not place keys in browser JavaScript, public mobile apps, or public repositories.
- Use the narrowest scopes your integration needs.
- Rotate keys if a teammate leaves or a key may have leaked.
- Revoke unused keys from the AdSkull API page.
Access Rules
API access requires Creator or higher.Safe URL Inputs
When endpoints accept URLs, AdSkull validates them before fetching content.Abuse Protections
AdSkull API protections include:- Creator-and-higher plan checks.
- Credit reservation before paid work starts.
- Credit refunds when eligible generation jobs fail.
- Ownership checks for jobs, assets, voices, and webhooks.
- Scoped API keys with per-key and per-account rate limits.
- Active job concurrency limits.
- Idempotency keys to prevent duplicate charges during retries.
- URL safety checks.
- Upload validation for MIME type, file extension, size, duration, dimensions, and malformed files.
- Short-lived download URLs for generated assets.
- Webhook signature verification and retry limits.