> ## Documentation Index
> Fetch the complete documentation index at: https://docs.adskull.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How to use AdSkull API keys safely.

API keys unlock paid generation capabilities, so treat them like production secrets.

## Key Handling

* Store keys only on servers, secret managers, or trusted workflow tools.
* Do not place keys in browser JavaScript, public mobile apps, or public repositories.
* Use the narrowest scopes your integration needs.
* Rotate keys if a teammate leaves or a key may have leaked.
* Revoke unused keys from the AdSkull API page.

## Access Rules

API access requires Creator or higher.

## Safe URL Inputs

When endpoints accept URLs, AdSkull validates them before fetching content.

## Abuse Protections

AdSkull API protections include:

* Creator-and-higher plan checks.
* Credit reservation before paid work starts.
* Credit refunds when eligible generation jobs fail.
* Ownership checks for jobs, assets, voices, and webhooks.
* Scoped API keys with per-key and per-account rate limits.
* Active job concurrency limits.
* Idempotency keys to prevent duplicate charges during retries.
* URL safety checks.
* Upload validation for MIME type, file extension, size, duration, dimensions, and malformed files.
* Short-lived download URLs for generated assets.
* Webhook signature verification and retry limits.