Skip to main content

Security and privacy

Protect API keys​

  • Store permanent keys in a secret manager or server environment variable.
  • Never commit keys to Git or include them in public examples.
  • Never put keys in URLs, query strings, browser bundles, mobile binaries, screenshots, logs, analytics, or support tickets.
  • Route browser and mobile traffic through an authenticated backend you control.
  • Revoke and replace a key immediately if it is exposed.

Use TLS​

Use only the secure public endpoints:

https://api.kittenml.com
wss://api.kittenml.com

Do not disable TLS certificate verification in production clients.

Minimize stored data​

Avoid sending sensitive speech or text unless it is necessary for your application. Store generated audio and transcripts only as long as your use case requires, and apply the access controls appropriate for your users.

Hosted requests create usage and operational metadata. ASR processing can also persist submitted or normalized audio and transcripts for service operation and support. A public retention period is not currently stated in these API docs; review your account terms and contact KittenML Support before sending data that has specific retention or deletion requirements.

Safe diagnostics​

Retain the x-request-id or request_id when a request fails. It is the safe identifier to include in a support report. Do not include the API key or sensitive input content.

Public examples​

All public examples use environment variables and placeholder credentials. Generated audio and local .env files are excluded from source control.

Last updated on