Each integration gets
its own permissions.

User isolation

Accounts receive separate workspaces with their own connections, history, files, queues and keys. The administrator panel manages users and service status; administrator permissions do not provide API access to another workspace's private chats.

Registration and sign-in

Self-service registration uses email verification. Passwords are stored as secure hashes, and sessions expire. Resetting a password or blocking a user revokes their active sessions and keys. A recovery email alone does not confirm that a password has changed.

Separate keys for projects

API keys support expiry, revocation and read/write permissions. Managing profiles, keys and administrators requires an account session. Start with read; allow changes only for the server-side handler that needs them.

Data transfer and files

The service domain uses HTTPS. Incoming requests are checked against permissions and workspace; files and messages have size limits. URL downloads and webhooks use public-address validation and destination restrictions.

Duplicate protection

Use one stable Idempotency-Key for each send operation. After a timeout, check the original message's status first. Retrying with a different key may create a second copy. Queuing, acceptance by the messenger and delivery to the recipient are different states.

What remains on your side

Keep secrets in your backend, verify webhook signatures, separate staff permissions, exclude sensitive data from logs and control AI commands. Use messages according to agreed workflows and messenger rules.

Capability limits

Ordinary accounts use native protocols; their operation and command set may change. An available operation does not guarantee delivery, freedom from account restrictions or automatic compliance with your business requirements. Assess the required protection level and data processing terms before connecting sensitive processes.

View the API contract →