Organization-owned API key
Each active Platform organization has one active production key. Authentication resolves requests to that organization before public production access is allowed.
Security & Data
Documented credential and media behavior, without unsupported compliance claims.
This page states only behavior that is part of the current Ruwana Platform contract. It does not substitute marketing claims for controls that have not been published as a contract.
Full secret shown once
The complete live key is revealed immediately after create or regenerate. Later Platform views expose safe masked key metadata rather than redisplaying the full secret.
Regeneration replaces the key
Regenerating the organization key replaces the previous production secret, so integrations should update their server-side secret store as one controlled rotation.
Generated media is temporary delivery
Platform-generated media is retained for a fixed seven-day window from original completion. Successful responses expose expiresAt and clientStorageRequired: true.
Before expiry
Use the returned media URL to retrieve the generated result and copy anything that must live beyond the delivery window into your own storage.
After expiry
Expired media URLs are removed from delivery while request, usage and billing records remain available as non-media history. Idempotent replay does not extend the original media deadline.
Integration-side key handling
- Keep
RUWANA_API_KEYin server-side secrets or environment configuration - Do not ship a live production key inside browser JavaScript, a public mobile bundle or source control
- Use the organization key only over HTTPS to
platform.ruwana.studio - Rotate the key if a secret is exposed and update dependent services deliberately
Scope of this public statement: Ruwana does not claim certifications, security standards, encryption guarantees or model-training/privacy behavior on this page unless those claims become separately verified and published.
Build with the verified contract.
Use Authentication for key mechanics and Media retention for the exact seven-day response fields.