01
Origin lock, recipient allow-list, locked From, sliding-window rate caps (per-IP / per-recipient / per-key), optional Turnstile or hCaptcha.
02
Vanilla JS, zero dependencies. The dashboard's create-key modal renders a per-key snippet with the freshly minted token embedded.
03
The MCP create-tool returns a single-use 5-minute reveal URL rather than the bare token, so secrets never sit in agent chat history.
04
Publishable keys reject attachments at the server. CSP can't defend against the exfiltration vector; we just don't allow it.
One HTTP call to get started