Skip to main content

Production checklist

Review these security measures before deploying your Biel.ai assistant to production.

Widget integrations​

  • Restrict allowed domains: List authorized domains in Settings > Security & Privacy > Access Control > Allowed domains.
  • Enable 2FA: Open My account > Profile and click Enable under Two-factor authentication for each dashboard user.
  • Configure data privacy: Enable PII removal or Terms & Conditions as needed. See Data privacy.
  • Limit client-side API key permissions: Public widgets need no key. For a private widget, use a project-scoped key with only the permissions its features need: projects_read, search, and chats_create in API v2. chats_create permits generating answers and consumes interactions. It is not read-only.
  • Secure high-privilege keys server-side: Store keys with write permissions (sources_create, sources_delete) in environment variables or a secrets manager. Never expose in client-side code.

API integrations​

  • Authenticate protected operations: Include Authorization: Api-Key <token> when calling private projects or operations that require a key. Check the endpoint's required permission in the API reference.
  • Rotate API keys regularly: Establish a rotation schedule for all active keys.
  • Store keys securely: Use environment variables, encrypted config, or a secrets manager (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault). Never hardcode or commit keys to version control.
  • Verify token access: Confirm tokens are not in public repositories and are shared only with authorized team members.
  • Remove unused keys: Open Team > API keys, select the key, and click Remove API key for keys that are no longer in use.