Secure AngeMedia
Web Studio, API access and provider authentication use different credentials. Review each boundary before exposing the service.
Keep three credential types separate
| Credential | Purpose | Do not use it for |
|---|---|---|
| Administrator account | Web Studio sign-in and configuration | Normal API clients |
| Gateway API key | Image/video API and protected media access | Upstream provider authentication |
| Provider API key | Gateway-to-provider requests | Browsers or external clients |
Before public access
- Use a long random administrator password and a separate Gateway key.
- Expose the service through an HTTPS reverse proxy and keep provider keys server-side.
- Limit upload size, download size, concurrency and queue capacity.
- Require authentication for
/generated/*and/uploads/*. - Allow only administrators to configure custom provider Base URLs.
Media files
Gateway should safely download and localize signed provider URLs. External responses must not reveal local filesystem paths, raw signed URLs, data URLs or complete provider responses.
Logs and diagnostics
- Never log complete API keys, Authorization headers or provider secrets.
- Show redacted errors and request IDs instead of sensitive raw request bodies.
- Inspect upload URLs, signed query parameters and local paths before sharing diagnostics.
External URLs
Reference images and provider results require URL validation, redirect re-checks, size limits and timeouts. Do not allow Gateway to become an arbitrary internal-network downloader.
After suspected exposure
- Revoke or rotate the affected key.
- Review recent jobs, administrator sign-ins and access logs.
- Remove public screenshots, issues or archives that contain secrets.
- Confirm that the new credential exists only in protected runtime configuration.