Platform
Settings And Security
Manage workspace configuration safely.
Verified implementation includes a /settings dashboard route, budget APIs, CXO API-key hashing/display helpers, and AI runtime connection routes that reject secret-like metadata. Some provider-specific limits and billing behavior are still enforced in product-specific routes and plan tables.
Security checklist
- Use individual user accounts.
- Store API keys only in the dedicated settings screens.
- Scope API keys to the product, domain, or deployment that needs them.
- Rotate keys when a teammate leaves or a client deployment changes owner.
- Keep CORS allowed domains narrow for website widgets.
- Review usage and alerts weekly.
Billing and usage
Usage can come from chatbot messages, voice sessions, agent runs, knowledge-base ingestion, Hermes telemetry, and developer automation. Use budget limits or alerts before giving broad access to expensive workflows.