Security

How Top Billing protects the things you trust it with. For a vulnerability report, use Contact.

API keys

• A key is shown once, at creation. Only its prefix is ever displayed again; the key itself is stored as a peppered hash.
• Revocation takes effect across the gateway within a second.
• Anything that is not a tb_ key is rejected with 401 and never forwarded upstream.

Provider credentials

Upstream credentials are held in a managed secret store, written by the console and readable only by the gateway. They are never stored in the application database, never logged, and never returned by any API.

Logs

Request logs carry ids, paths, status codes and timings. Keys, key hashes, authorization header values and prompt or completion text are kept out of logs, and this is covered by an automated test.

Errors

Error messages never reveal upstream vendors, hostnames, upstream model ids, keys, SQL or stack traces.

Money

Every movement of credits happens in database functions with row locks and idempotency. The transaction ledger and usage ledger are append-only; a correction is a new compensating entry, never an edit.

Transport and browser

TLS everywhere, HSTS, and a strict content security policy with frame-ancestors 'none' on the website and console.

Operators

The admin console requires TOTP multi-factor authentication, sessions have an absolute lifetime, and role changes need a second super administrator’s approval.