Documentation

Credential Safety

Private local M1 candidate. Hosting and external acceptance remain open.

Versioned canonical source. An update timestamp is not supplied by this content registry.

PDF uses your browser’s print dialog. It is not a hosted export service.

Browser: short-lived token provider only; no Platform API key.
Server: environment-scoped API key or token provider, never client-shipped.
ESP32: future per-device credential in encrypted NVS when supported; never a Project API key, Kconfig plaintext or serial-log value.
Realtime: single-use ticket, passed only to the canonical Realtime authority.
Test and live credentials are never interchangeable.

The local preview contains no credential and performs no authentication.

Source and provenance

Surface: docs
Canonical source: docs/guides/CREDENTIAL_SAFETY.md
Canonical spec SHA-256: b4b9c06106eeaacd9b3d12592b48d82b4247853bea70c203aa8fe5e76500d37f

View original Markdown

# Credential Safety

- Browser: short-lived token provider only; no Platform API key.
- Server: environment-scoped API key or token provider, never client-shipped.
- ESP32: future per-device credential in encrypted NVS when supported; never a
  Project API key, Kconfig plaintext or serial-log value.
- Realtime: single-use ticket, passed only to the canonical Realtime authority.
- Test and live credentials are never interchangeable.

The local preview contains no credential and performs no authentication.