Security Overview

Vibe Affirmations API

✅ Security Features Implemented

1. RapidAPI Authentication

2. Tier-Based Access Control

3. Lambda Security

4. CloudWatch Monitoring

5. Demo Endpoint Rate Limiting

6. API Gateway Protection

🔒 RapidAPI Configuration

Header Validation

Every authenticated request must include:

X-RapidAPI-Key: your_api_key_here
X-RapidAPI-Host: vibe-affirmations.p.rapidapi.com
X-RapidAPI-Subscription: BASIC | PRO | PREMIUM

The Lambda function validates the X-RapidAPI-Proxy-Secret header (internal) to ensure requests originate from RapidAPI's proxy layer.

SSM Parameter Store

The RapidAPI secret is stored securely in AWS Systems Manager Parameter Store:

⚠️ Important: Direct calls to the AWS Lambda endpoint without the RapidAPI proxy secret will be rejected with 403 Forbidden.

🛡️ Data Privacy & Protection

Zero Data Retention

BYOK Model (Live AI Endpoint)

For custom AI-generated affirmations, users must provide their own OpenAI API key:

Privacy Best Practice: The BYOK model means your custom affirmation topics are processed directly by OpenAI's API. ApiaryLabs never stores or logs your topics or generated content.

GDPR Compliance

🔐 Best Practices for Developers

1. Protect Your API Keys

⚠️ Never expose API keys in:
  • Frontend JavaScript code (client-side)
  • Git repositories or version control
  • Public documentation or screenshots
  • Mobile app binaries (reverse-engineerable)
  • Error messages or logs

2. Use Backend Proxies

For web and mobile apps, proxy API calls through your backend:

// ✅ Good: Backend proxy
// Frontend → Your Server → Vibe API
fetch('/api/affirmation?vibe=hype')

// ❌ Bad: Direct frontend call
fetch('https://vibe-affirmations.p.rapidapi.com/...', {
  headers: { 'X-RapidAPI-Key': 'exposed_key' } // 🚨 Don't do this!
})

3. Environment Variables

# .env file (never commit to Git)
RAPIDAPI_KEY=your_key_here
RAPIDAPI_HOST=vibe-affirmations.p.rapidapi.com

# .gitignore
.env
.env.local
.env.*.local

4. Rotate Keys Regularly

5. Monitor Usage

🚨 Security Incident Response

If You Suspect Key Compromise:

  1. Revoke immediately: Go to RapidAPI dashboard → API Keys → Delete
  2. Generate new key: Create replacement key
  3. Update applications: Deploy new key to all environments
  4. Check logs: Review RapidAPI analytics for suspicious activity
  5. Contact support: Email [email protected] if abuse detected

Report Security Issues

Found a security vulnerability? Contact us:

🔍 Monitoring & Alerts

CloudWatch Alarms (AWS Side)

Alarm Threshold Action
High Error Rate >50 errors in 5 minutes SNS notification to ops team
Slow Responses P99 latency >3 seconds Investigate performance issues
Tier Violations >10 in 5 minutes Check for subscription misconfigurations

RapidAPI Analytics (Your Side)

Monitor your API usage in the RapidAPI dashboard:

📜 Compliance & Certifications

Infrastructure Compliance

Third-Party Dependencies

Audit Trail: All API access is logged (metadata only) and retained for 7 days in CloudWatch. Full audit logs available upon request for Enterprise customers.

💡 Security FAQ

Q: Can I use the API from frontend JavaScript?

A: Demo endpoints are safe for frontend use (no auth required). For authenticated endpoints, use a backend proxy to protect your API key.

Q: What happens if my API key is leaked?

A: Revoke the key immediately in RapidAPI dashboard. Generate a new one and update your applications. Check analytics for unauthorized usage.

Q: How long are CloudWatch logs retained?

A: 7 days by default. Enterprise customers can request extended retention.

Q: Does the API store my custom affirmation topics?

A: No. Topics sent to the live AI endpoint are processed by OpenAI and immediately discarded. We don't log or store custom topics.

Q: Is the demo endpoint rate-limited?

A: Yes. 100 requests/day per IP address (10 requests/minute burst limit).

Q: Can I whitelist IP addresses?

A: Enterprise customers can request IP whitelisting. Contact [email protected].

← Vibes Guide Terms of Service →