Security & data handling

Understand which GymAssets credentials may be public, what the public site can access, and where customer data is processed.

Public assets, customer sessions, catalogue data, and operator tools are served by separate systems. This documentation site is static. It reaches no database, no storage, no secret, and no session.

Credentials

Publishable keys are designed for image URLs and may appear in page source. Their protections are origin restrictions, burst limiting, and the account allowance.

Secret keys authenticate the data API and belong only on a server. They are stored as hashes for request authentication. Do not send one in a browser bundle, image URL, spreadsheet, presentation, support request, or source repository.

Customer sessions

Customer authentication lives on app.gymassets.dev. Its session cookie is scoped to that hostname and is not presented to gymassets.dev when someone reads this documentation.

Data returned by the APIs

Catalogue responses are the same for every authorized customer. Customer-specific behavior on image requests is limited to key configuration such as origins, theme, allowance status, and whether a rendered image carries the GymAssets mark.

For a security concern, contact contact@gymassets.dev without including credentials or sensitive customer data.