> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ondial.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security guidelines

> Key handling, consent, DNC, and kill switch.

* Store keys in a secret manager; rotate via Super Admin revoke + new approve
* Prefer **sandbox** keys in CI and Try It
* Never embed keys in client apps, docs, tickets, or chat
* Public API never returns SMTP passwords, WhatsApp/AiSensy API keys, access tokens, or webhook verify tokens — `GET /omni/templates` only returns names, ids, and empty `lead` fields to fill
* If a live `ond_live_…` key was pasted anywhere, revoke it and request a new one
* Call channel requires `consent.outboundCall` and clear DNC
* Prefer HTTPS webhook endpoints in production
* Use kill switch before mass revoke when investigating abuse