Phuze

Security

← Developer Docs · API Reference · Agent skill: phuze-skill.md

Key safety

  • Your publishable_key is safe to include in frontend code and HTML. It is visible to anyone who views your source.
  • Your secret_key must never appear in frontend code, client-side JavaScript, or version control. Store it as a server-side environment variable only.
  • If your secret_key is compromised, call POST /api/v1/clients/me/keys/rotate (CLI: phuze keys rotate (WIP)) immediately. The old key is invalidated in real time.
  • If a CLI token leaks, revoke it (DELETE /clients/me/cli-tokens/:prefix; CLI: phuze keys revoke (WIP)) — revocation is enforced in real time. If you're unsure what's exposed, the dashboard's Revoke everything & reissue (confirmed by an email code) rotates the secret key and revokes all CLI tokens and dashboard sessions at once.
  • Sensitive changes (key rotation, token issue/revoke) are recorded and trigger a security email to the owner address, so unexpected activity is visible.

Domain allowlisting

Phuze validates the Origin header on all browser-facing API calls. If a request originates from a domain not in your authorized list, it is rejected before any auth logic runs. This prevents other sites from using your publishable_key to send magic links under your quota.

Add all domains where your app is embedded, including any staging or preview URLs you use during development. localhost and 127.0.0.1 (any port) are always allowed during development for any client. Verify your domain list via GET /api/v1/clients/me (CLI: phuze domains list (WIP)).

Session tokens

Session tokens are opaque strings. They are stored in the user's browser (localStorage by default) and must be treated with the same care as a cookie — they grant access to the user's session. Use HTTPS at all times.

Sessions expire after 30 days. You can revoke any session immediately via POST /sessions/revoke or by calling Phuze.logout() from the frontend.

What Phuze does not store

Phuze does not store passwords (there are none — login is always via magic link). Phuze does not store the plaintext session token or secret key — only cryptographic hashes. If the Phuze database were compromised, no secret key or session token could be recovered from it.

Phuze · phuze.edato.me · Developer Docs · API Reference