Skip to main content
  • Store keys in a secret manager; rotate via Super Admin revoke + new approve
  • Prefer sandbox keys in CI and Try It
  • Never embed keys in client apps, docs, tickets, or chat
  • Public API never returns SMTP passwords, WhatsApp/AiSensy API keys, access tokens, or webhook verify tokens — GET /omni/templates only returns names, ids, and empty lead fields to fill
  • If a live ond_live_… key was pasted anywhere, revoke it and request a new one
  • Call channel requires consent.outboundCall and clear DNC
  • Prefer HTTPS webhook endpoints in production
  • Use kill switch before mass revoke when investigating abuse