Security overview
Built for production from day one
NexApi treats keys, limits, validation, and observability as core product features, not add-ons you configure after launch. This page describes what the platform actually does today.
API keys
- Keys are hashed at rest; the secret is shown once, at creation.
- Scopes (read, write, admin) limit what each key can do.
- Optional expiry and IP allowlists per key.
- Revocation is immediate: a revoked key stops working on the next request.
Runtime guardrails
- Schema validation runs on every request before your logic executes.
- Per-endpoint rate limits reject excess traffic early.
- CORS is an explicit allowlist that you control per project.
- Failed requests are logged with request IDs for follow-up.
Access control
- Organizations with member roles (owner, admin, member, viewer).
- Invites expire and can be revoked or rotated before acceptance.
- Production APIs are never a single shared password.
Logging and audit
- Searchable request logs with status, latency, and origin.
- Analytics for error rates and latency per endpoint.
- Internal admin actions are recorded in an audit trail.
Data handling
- Connector credentials (database passwords, tokens) are stored separately from public configuration and never returned by the API.
- Passwords are hashed with an adaptive algorithm; sessions use HTTP-only cookies.
- Blog and user-generated markdown is sanitized before rendering.
Responsible disclosure
Found a vulnerability? Email us and we'll respond as quickly as we can. Please include steps to reproduce and avoid accessing data that isn't yours.