Responsible use

FluidGhost produces distinct variants of media you own or are authorized to process. This page covers keeping your API key safe and using the API responsibly.

Protect your API key

Your key acts as your account and spends your balance, so treat it like a password.

• Keep it server-side. Never embed a key in a browser app, mobile app, or anything you ship to end users — a shipped key is a published key. Put your own backend in front and call FluidGhost from there.
• Store it as a secret. Use environment variables or a secret manager, never source control.
• Rotate on exposure. If a key might have leaked, generate a new one, deploy it, then revoke the old one in the dashboard. Revocation is immediate.
• One key per integration. Separate keys per service make it easy to revoke just the affected one and to attribute usage.

Data handling

• Sources are transient. Uploaded originals live under a short-lived temp/ prefix and are expired automatically; they exist only long enough to run the job.
• Choose your result footprint. drive delivery persists results in your FluidGhost Drive until you delete them. ephemeral delivery keeps nothing: results delete on download and are purged within an hour regardless. Pick the one that matches your retention needs — see Delivery modes.
• Owner isolation. Every job, result, and inspection is scoped to the account that created it. There is no cross-account access; a resource that isn't yours returns 404.

Acceptable use

Only submit media you own or are authorized to process, and use the output in line with the terms of the platforms you post to and applicable law. Don't use the API to impersonate real people or organizations, to deceive in ways that cause harm, or to evade safety, moderation, or legal obligations. FluidGhost may rate-limit, suspend, or revoke access for abuse. If you're unsure whether a use is acceptable, ask before you build on it.