Security guide

Publishable React keys for the public beta.

The initial launch supports exact-origin React client keys. Server API keys and trusted-backend token flows are coming later.

Inscription développeur

Clerk manages email and Google signup, dashboard sessions, and workspace invitations. Each Genie workspace has one owner and a default project. Developer accounts are limited to that project and remain owner-only. When paid plans launch, Pro and Max accounts can create unlimited isolated projects; Pro supports five seats, while Max supports unlimited seats. Read, Write, and Admin access is assigned per project.

Clés client React

Create a publishable React client key in Dashboard → API keys. Choose the project whose reviewed jobs the key may play, then add exact browser origins, including the protocol and port. Use separate keys for local development, staging, and production. Wildcard domains are not accepted.

<GenieProvider clientKey={import.meta.env.VITE_GENIE_PLAYER_CLIENT_KEY}>
  <GeniePlayer
    jobId="translation-job-id"
    src="https://customer-cdn.example/video.mp4"
  />
</GenieProvider>

The SDK sends the client key in an X-Genie-Client-Key header with one completed jobId. Genie verifies the requesting Origin, project ownership, key status, and completed review before issuing a ten-minute browser token. That token is restricted to the job's media, media:read, and the same origin.

Publiable ne signifie pas privilégié

A client key can appear in a browser bundle. It cannot list jobs, upload, edit, delete, access another project, or retrieve an unreviewed job. Revoke it from the dashboard at any time; existing browser tokens expire within ten minutes.

Limite des origines autorisées

Origin checks stop another website from casually reusing your key in browser JavaScript. They are not user authentication: a non-browser client can forge an Origin header, and a client key is visible to anyone who can load your frontend. The reviewed job ID and job-scoped read token limit the impact, but they do not make private video entitlements public-safe.

Private playback is on the roadmap

Per-user private-video authorization will use a trusted backend and narrowly scoped browser tokens. Server API key creation is not available during the initial public beta.

Server credentials · Coming soon

Future trusted-backend integrations will use opaque, project-bound server API keys to mint short-lived browser tokens for private products. Node.js and Python SDKs, server API key creation, and production instructions for this flow remain unavailable at the initial launch.

React only at launch

Process and review captions in the dashboard, create a publishable client key, and use @genie-player/react with customer-hosted video. Do not attempt to create or deploy server credentials yet.

AI agent OAuth

The beta Genie MCP endpoint accepts only Clerk oauth_token credentials negotiated by a compatible remote-MCP client. It maps the agent to the active workspace and assigned project but exposes only React setup tools. Dashboard sessions, Clerk user API keys, publishable client keys, and Genie browser tokens are rejected on /mcp.

Clerk OAuth currently uses openid; Genie enforces least privilege through its fixed tool surface. See Agent Setup for client configuration and the exact approval boundary for one-time key creation.

Suppression du compte

Deleting a collaborator's Clerk user removes that membership and its project grants. If a workspace owner is deleted, Genie preserves the workspace, freezes billing and membership administration, and opens a 30-day support-transfer window. Existing members keep their ordinary project access; unresolved workspaces become read-only instead of being purged.

Launch credential boundaries

Clerk sessions access the dashboard, Clerk OAuth tokens access setup-only MCP, publishable React client keys request job-scoped playback sessions from approved domains, and Genie browser tokens read captions briefly. Server API keys join this model later.