Widget Security

Rapidflare is built with security at its core. This document explains how the Rapidflare widget securely integrates into your public-facing web apps while ensuring protection against abuse, impersonation, and unauthorized access. From bot mitigation to publishable API key protection, we’ve implemented modern, multi-layered defenses to help you ship with confidence.

Key Security Principles

We designed the Rapidflare widget with these core principles:

• Secure by default: Every integration point includes protections against tampering, misuse, and impersonation.
• Invisible yet effective protection: An invisible reCAPTCHA check silently protects user sessions.
• Granular access control: Domain-restricted publishable API keys and signed verification tokens ensure tight boundaries.
• Transparency and compliance: Clear infrastructure and security practices ensure trustworthiness.

How Authentication Works

Our authentication system uses domain-bound publishable API keys and reCAPTCHA Enterprise to validate every interaction and prevent unauthorized access.

1. Domain-bound publishable API keys

A publishable API key works only on the domains you allow, so a copy of your key does not work on someone else's site. It uses:

• An allow-list of domains for every publishable key, with at least one domain required
• Sub domains of an allowed domain included automatically
• Enforcement by Rapidflare's backend on every request

2. Invisible reCAPTCHA, with a challenge as the way through

reCAPTCHA Enterprise runs silently in the background, assigning a risk score (0.0–1.0) based on user behavior. It blocks known bots while preserving the user experience.

• Invisible UX: No interaction needed by the end user
• Risk scoring: Every request from a publishable key is scored and the score check cannot be turned off
• One-click challenge: If a visitor's score is too low and the key's challenge switch is on, the visitor solves a one-click checkbox from Google and carries on. With the switch off, the request is refused

3. Signed verification tokens

After a visitor passes the reCAPTCHA check, Rapidflare issues a signed token that is tied to your API key and expires after a short time. This ensures:

• Requests cannot be forged without passing the check
• A token only works for the API key it was issued for

Integration Options

Rapidflare securely supports multiple embed methods:

Setting up allowed domains

Before you can integrate AI Agents into your enterprise, you will need to grab your publishable API key from your dashboard. You can find it under Hubs » Configure » Security.

Every publishable key needs at least one allowed domain (sub domains are included automatically). Only requests coming from your allow-listed domains work; requests from all other domains are blocked. You can add up to 250 domains and change them at any time. See API keys for how to create and update keys.

Domains must be real, public hostnames: localhost and other loopback addresses cannot be allowed on a publishable key, so test on a hostname you control, such as staging.yoursite.com.

Secret API keys are different: they are for automation testing of your widgets in protected environments, and they skip the domain and reCAPTCHA checks. Never put one in browser code, log it, store it on disk, or make it accessible to your end users. If a secret key is ever exposed, delete it and create a new one (see If a key leaks).

If your site sets a Content-Security-Policy, see Content Security Policy for what to allow.

Why This Matters: Key Benefits

Questions or Concerns?

Reach us at support@rapidflare.ai for any questions, audits, or detailed integration support.