Security & data

API key handling

• The full API key (alt_live_...) is shown once when it is created. Alt stores only a keyed hash of the secret, so the original value cannot be displayed again. Create a new key if you lose it.
• The full webhook signing secret (whsec_...) is also shown once. Alt stores it encrypted with AES-256-GCM and uses it only to sign outgoing deliveries, so it cannot be viewed again in the console. Recreate the endpoint to issue a new secret.
• Store keys in a secret manager. Never embed them in client-side code, mobile apps, or repositories.
• To rotate a key, issue a new one for the same integration in the console. Switch your systems to the new key, then revoke the old one. Revocation takes effect immediately.
• Optionally set an expiration when creating a key; expired keys are rejected automatically.
• Use a separate key for each system. Keep staging and production separate so revoking one key does not interrupt the other environment.
• There is no sandbox or test mode. Every API key can read real notes. Use separate integrations for staging and production. To test a receiver without waiting for a recording, use the verification event sent when an endpoint is created or Send test in the console.

Data each integration can access

• A personal integration can access only its owner's personal notes. A teamspace integration can access only notes shared with that teamspace, never a member's personal notes.
• Teamspace integrations can only be created by the teamspace owner.
• Requesting a note outside the API key's visibility scope returns 404. The response does not reveal whether the note exists.
• When a note leaves your scope you receive note.deleted (reason: access_lost) and the note disappears from your listings. Delete or block access to your stored copy.

Scopes

Grant only the scopes your integration needs. A request that requires a scope not granted to the API key fails with 403 insufficient_scope.

Rate limits

• Each API key can make up to 120 requests per minute. Exceeding the limit returns 429 rate_limited with a Retry-After header. Wait for at least the indicated duration before retrying.
• Use webhooks and incremental sync with updated_after instead of repeatedly polling the full note list.
• Store the ETag from note, transcript, and summary responses and send it in If-None-Match on the next request. Unchanged content returns 304 without a response body, reducing unnecessary data transfer.

Privacy

• Transcripts and summaries are user content and may contain personal data. Fetch only what your integration needs, and protect what you store.
• Honor deletions. When you receive note.deleted, delete or block access to your stored copy regardless of the reason. Periodically check the full note list in case you missed an event.
• Webhook URLs must be public HTTPS endpoints. Private, loopback, and cloud-metadata addresses are rejected, and redirects are not followed.
• API access requires an active subscription on the integration's workspace; without one, requests fail with 403 plan_required.
• See our Privacy Policy for how Alt itself handles user data.