Skip to content

API Security Built Into Every Generated API

Generated code is only useful if it passes your security review. This page explains how APIGenerator protects access, data and your ability to leave.

Authentication and access control

  • API keys, JWT and OAuth2 client credentials on every API.
  • API keys are hashed at rest and shown in full only once, when you create them.
  • Each key has its own scopes, rate limit and expiry, and you revoke it in one click.
  • Roles for owners, developers and viewers on shared projects.
  • Single sign on with SAML and user provisioning with SCIM on Enterprise.

Data protection

  1. Traffic to the dashboard and to hosted endpoints uses HTTPS only.

  2. Stored data, secrets and backups are encrypted at rest.

  3. Files you use in the public demo are parsed in your browser and never uploaded.

  4. Your schemas, files and data are never used to train AI models.

  5. Enterprise includes a data residency choice and private networking.

Safe access for AI agents

An MCP server is another client of your API, so it follows the same rules. Agents receive their own keys, see only the tools their scopes allow, and every call appears in the logs. The mcp gateway puts all agents behind one governed endpoint.

Change control and audit

  • Change review on Team, so schema changes are approved before they reach production.
  • Separate dev, staging and production environments.
  • An audit log of schema changes, deployments and key actions on Enterprise.
  • Versioning, so a breaking change never surprises existing clients.

Secure defaults in generated code

  1. Input validation on every endpoint from types, constraints and your rules.

  2. Parameterised queries, never string built SQL.

  3. Pagination limits that stop unbounded reads.

  4. Contract tests that fail when a response leaves the documented shape.

You can always leave

Code export is part of every plan. You download the full project with a Dockerfile and tests and run it on your own infrastructure at any time.

Security review pack

Enterprise includes a security review pack with our answers to common vendor questionnaires, the data handling description and the SLA terms. Questions go to [email protected].