# Native1API Security

Native1API is designed as a production AI API supplier with authenticated API access, developer keys, account controls, and usage visibility.

Security principles:

- Protected API routes require authentication.
- Developer API keys are shown once at creation time.
- Stored API key records use one-way hashing and account-scoped metadata.
- Public site files must not contain secrets, internal supplier details, or private margin data.
- Secrets should live only in approved secret storage.
- Error messages should not expose private credentials or internal operating details.

Production launch requirements:

- Verify API key creation, hashing, authentication, and revocation.
- Verify billing and credit accounting before enabling paid checkout.
- Verify rate limiting and abuse controls.
- Verify no secrets are exposed in public bundles, logs, crawler files, or API responses.