---
title: "LookValid security: keys, tokens and stored data"
url: "https://lookvalid.com/security.md"
canonical_url: "https://lookvalid.com/security"
last_updated: "2026-10-19"
type: "conceptual"
summary: "How LookValid handles API keys, MCP sign-in tokens, the pages it fetches for you, rate limits and stored data, and where to report a problem."
related: ["https://lookvalid.com/docs/authentication.md", "https://lookvalid.com/legal/privacy.md"]
---

# LookValid security: keys, tokens and stored data

How LookValid handles API keys, MCP sign-in tokens, the pages it fetches for you, rate limits and stored data, and where to report a problem.

## API keys

- A key is shown once, when you create it. We store only a one-way hash and a short prefix, so a lost key cannot be recovered and a database read does not reveal a usable key.
- The dashboard and the account endpoint list keys by id and prefix and never return a full key.
- You can keep several keys, one per application or environment, and revoke any of them. A revoked key stops working on the next request.
- A malformed, unknown or revoked API key gets the same 401 on the REST API, so it does not tell a caller which keys exist. Repeated failures from one address are answered with a 429 for a while.

## Agent sign-in over MCP

An MCP client can sign in with OAuth instead of holding an API key.

- Authorization uses the authorization code flow with PKCE (S256). Clients register themselves with https or loopback addresses only.
- Access tokens last one hour. Refresh tokens rotate each time they are used. Tokens and codes are stored hashed.
- A token opens the MCP server only. It never works on the REST API, and you can revoke it under Connected apps in the dashboard.

## Pages we fetch for you

Some lookups read a web page you name. Every such request goes through one guarded fetcher.

- Only http and https on ordinary ports, with no credentials in the address. A host is refused unless every address it resolves to is public, so requests cannot be aimed at private networks or cloud metadata.
- The address is checked again on every redirect, up to 5 redirects. The check runs on the same connection the request uses, so a name cannot change its answer between the check and the fetch.
- Each fetch has a 10 second deadline, the body is capped at 5 MB after decompression, and no cookies are sent. Tools that read several pages stop after 25 seconds in total.
- At most 2 requests are in flight to any one site, and a 429 or 503 answer is retried twice with backoff, so our servers cannot be used to hammer a target.

## Limits

- Each API key is limited to 200 requests per 10 seconds, and an account can run 16 lookups at once.
- Inputs are validated before any data source is called, and a rejected or failed request is not charged.

## What we keep

- Account data, the hash of each key, a ledger of credit grants and charges, and a request log with the product, outcome, credits and time. The log does not hold the value you looked up.
- A cached copy of each completed result, for your account only, for up to 7 days, and less for the products with a shorter cache window.
- Files you upload for bulk jobs are kept for 30 days.
- Card payments are handled by Stripe, so card numbers never reach our servers. Sign-in is handled by Google Firebase Authentication.

## Report a problem

- Write to hello@lookvalid.com with Security in the subject. Include what you saw and how to reproduce it, and never include an API key.
- If a key may have leaked, revoke it in the dashboard first, then create a new one.

## Related

- [Authentication](https://lookvalid.com/docs/authentication.md)
- [Privacy policy](https://lookvalid.com/legal/privacy.md)