Skip to main content

​
Protect your keys

An API key is a password for your organisation’s access and quota.
  • Keep keys on servers. Never put a key in browser JavaScript, a mobile app, a desktop app you distribute, or anything else a user can inspect.
  • Store keys in a secret manager, or at least in environment variables, never in source code. Add a secret scanner to your repositories and CI.
  • Never send a key in a URL. The API rejects keys in the query string with 401, because URLs leak into logs, browser history and analytics tools.
  • Use one key per service and environment: production, staging and CI each get their own, and only production uses a pk_live_ key. One leak then affects one system, and the usage figures tell you which system made which calls.
  • Keep keys out of your logs. Log the X-Request-Id of a response, not the request headers.

​
Call the API from your servers

The API accepts browser requests only from this documentation site, https://docs.pinakelai.com, for the playground. Browser code on your own domains is refused by the browser’s CORS checks. This is deliberate: a key in browser code is exposed to every user. Call the API from your backend and pass the results to your front end.

​
Transport

The API is served over HTTPS only, with HTTP Strict Transport Security. Keep certificate verification switched on in your HTTP client; never disable it to work around a proxy.

​
The API is read-only

No endpoint changes data. POST /v1/trademarks/batch uses POST only to carry a list of ids. A leaked key exposes data you are entitled to and consumes your quota; it cannot alter anything.

​
Brute-force protection

Requests with unknown keys are counted per IP address. After 20 within a minute, that address gets 401 with a Retry-After header for 5 minutes, even with a valid key, unless that key was used successfully within the last minute. If several systems share one egress address, one misconfigured system can lock out the others: fix wrong keys rather than retrying them.

​
If a key leaks

  1. Rotate it in the customer portal at portal.pinakelai.com. The old key stops working within about a minute. Deploy the new key.
  2. Check your usage in the portal or with GET /v1/usage for calls you did not make.
  3. Tell us at support@pinakelai.com with the key’s name (never the key itself) and the time range, so we can review the requests made with it.

​
Reporting a vulnerability

If you find a security problem in the API or this site, email support@pinakelai.com with the subject “Security”. Please do not test it against other customers’ data or degrade the service while you investigate.