Keys never reach the browser
Project API keys live on your server and mint short-lived sessions. Only the session crosses to the browser, and key secrets are shown once and stored hashed.
Security
How the hosted SketchAPI platform protects your keys, your origins, and your users' work.
Sessions are one-time and short-lived
Each session mounts exactly once, expires within minutes if unused, and its token is never placed in a URL. The client refuses to mount a session whose token leaks into the frame address.
Origins are allowlisted exactly
Sessions are minted for one registered browser origin and the hosted frame enforces it with a per-session Content-Security-Policy frame-ancestors header. Unregistered origins cannot embed the editor.
The editor is isolated from your page
Sketchpad runs in an origin-isolated frame with its own runtime, renderer, and workers. Your application talks to it through one typed message channel; no editor code enters your bundle.
Drawings stay where you put them
The hosted frame holds documents in the browser for the session. Persistence is your call: export through the save API to your own storage. There is no implicit cloud copy of your users' work.
Scoped keys and metered usage
API keys carry explicit scopes, session creation is rate-limited per minute and per month, and every session and operation is metered so you can audit activity from the dashboard.
Full contracts live in the documentation, the error code reference, and the privacy policy. For security reports or questions, contact us.