Security

How API keys, agent sign-in, fetched pages and stored data are handled, in the terms the code uses.

API keys

A key is shown once, when you create it. We store only a one-way hash and a short prefix, so a lost key cannot be recovered and a database read does not reveal a usable key.
The dashboard and the account endpoint list keys by id and prefix and never return a full key.
You can keep several keys, one per application or environment, and revoke any of them. A revoked key stops working on the next request.
A malformed, unknown or revoked API key gets the same 401 on the REST API, so it does not tell a caller which keys exist. Repeated failures from one address are answered with a 429 for a while.

An MCP client can sign in with OAuth instead of holding an API key.

Authorization uses the authorization code flow with PKCE (S256). Clients register themselves with https or loopback addresses only.
Access tokens last one hour. Refresh tokens rotate each time they are used. Tokens and codes are stored hashed.
A token opens the MCP server only. It never works on the REST API, and you can revoke it under Connected apps in the dashboard.

Some lookups read a web page you name. Every such request goes through one guarded fetcher.

Only http and https on ordinary ports, with no credentials in the address. A host is refused unless every address it resolves to is public, so requests cannot be aimed at private networks or cloud metadata.
The address is checked again on every redirect, up to 5 redirects. The check runs on the same connection the request uses, so a name cannot change its answer between the check and the fetch.
Each fetch has a 10 second deadline, the body is capped at 5 MB after decompression, and no cookies are sent. Tools that read several pages stop after 25 seconds in total.
At most 2 requests are in flight to any one site, and a 429 or 503 answer is retried twice with backoff, so our servers cannot be used to hammer a target.

Each API key is limited to 200 requests per 10 seconds, and an account can run 16 lookups at once.
Inputs are validated before any data source is called, and a rejected or failed request is not charged.

Account data, the hash of each key, a ledger of credit grants and charges, and a request log with the product, outcome, credits and time. The log does not hold the value you looked up.
A cached copy of each completed result, for your account only, for up to 7 days, and less for the products with a shorter cache window.
Files you upload for bulk jobs are kept for 30 days.
Card payments are handled by Stripe, so card numbers never reach our servers. Sign-in is handled by Google Firebase Authentication.

Write to hello@lookvalid.com with Security in the subject. Include what you saw and how to reproduce it, and never include an API key.
If a key may have leaked, revoke it in the dashboard first, then create a new one.