Encrypted credentials
Provider API keys should be encrypted before storage using keys managed separately from database contents.
Security model
Control credentials without spreading them across every application.
Security depends on both platform safeguards and responsible customer configuration.
Secret masking
Saved credentials must not be displayed again in full. Replacement and deletion workflows should avoid exposing existing secrets.
HTTPS transport
Public site, dashboard, and API communication must use HTTPS in production.
Application isolation
Each application receives its own CamiloAPI key, functions, provider access, environment, rate limits, and budgets.
Access isolation
Credentials, logs, applications, usage, and routing rules must remain scoped to their owning workspace.
Sensitive-data redaction
Logs should avoid authorization headers, passwords, keys, session tokens, and unnecessary request payloads.
Hashed application keys
CamiloAPI keys should be shown once and stored as hashes where practical, with only prefixes and final characters retained for identification.
Provider responsibility
Customers remain responsible for provider terms, permitted uses, data processing, account security, and third-party charges.
Security question?
Contact [email protected]. Do not send API keys or sensitive credentials by email.