Can I call FreeModel directly from browser code?
Can I call FreeModel directly from browser code?
Do not expose a secret API key in browser JavaScript or a mobile binary.
Send requests from your server and apply user-level authorization there.
Where should I store the API key?
Where should I store the API key?
Use a secret manager or server-side environment variable. For local tools,
use their encrypted credential store or a user-level configuration excluded
from version control.
What should I do if a key is exposed?
What should I do if a key is exposed?
Delete the key immediately under Console > API Keys, create a new one,
update the affected environments, and review request logs for unexpected use.
How do I secure a webhook endpoint?
How do I secure a webhook endpoint?
Every webhook needs a
webhook_secret of 16 to 256 characters. Verify the
X-Gateway-Webhook-Signature header over the raw request body, reject
timestamps more than five minutes old, and deduplicate deliveries on the
event id.Can reference images use private URLs?
Can reference images use private URLs?
No. Public
http or https URLs must use a public hostname. Private,
loopback, local, credentialed, and reserved destinations are rejected.
GPT Image 2.5 Ext also accepts PNG, JPEG, or WebP Data URLs in
image_urls. Video references remain public URLs only.