Security & abuse protection
What the API does to keep your data safe.
- Hashed keys: keys are stored as SHA-256 hashes and compared by hash, so a database leak doesn't reveal them.
- Brute-force protection: too many invalid keys from one IP triggers a temporary block (
too_many_failures). - Per-key and per-IP limits: each key has its own quota, and a global per-IP limit stops one client from flooding the API.
- Strict input limits: JSON bodies are capped at 16 KB and uploads at your plan's file size. Handles, IDs and query values are validated before any database lookup.
- No keys in URLs:
?key=is refused, so keys don't leak through logs or referrers. - Content checks: images are validated by file signature, and scriptable formats are refused.
- Privacy: users can hide themselves from the API, and hidden stats stay hidden.
- Safe responses: every API response is sent with
no-storecaching,nosniff, and no internal error details.
still stuck? try troubleshooting or open a ticket in our discord, we reply fast.