Security, SSO, and Data Compliance in Nomiq Workspace

​

API Key Security

• Store keys in environment variables, never in source code. Use your hosting provider’s secret management system (for example, Vercel Environment Variables, AWS Secrets Manager, or a .env file excluded from version control).
• Never commit keys to a repository. Even in a private repo, keys embedded in code are a significant risk if the repo is ever made public or if a contributor’s machine is compromised.
• Create one key per integration. If you have a staging environment and a production environment, generate a separate key for each. This way, rotating a compromised key does not affect other integrations.
• Set a hard API cap. In Settings > Billing, set a monthly generation cap. If a key leaks, the cap limits the financial damage while you respond.

​

Rotating an API Key

1. Go to Settings > Security > API Keys.
2. Find the key you want to rotate and click Rotate.
3. Copy the new key value displayed in the modal—Nomiq shows it only once.
4. Update every environment or service that uses the old key before closing the modal.
5. Click Confirm Rotation. The old key is revoked immediately.

# Set your API key as an environment variable (never hardcode it)
export NOMIQ_API_KEY="nm_live_xxxxxxxxxxxxxxxxxxxx"

# Reference it in your application code
curl https://api.nomiq.ai/v1/generate \
  -H "Authorization: Bearer $NOMIQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"project_id": "proj_abc123", "prompt": "minimalist tech startup"}'

​

Workspace Access Control

​

Single Sign-On (SSO)

​

Configuring SSO with Okta

​

Data Handling and Compliance

​

Webhook Signature Verification

import { createHmac, timingSafeEqual } from "crypto";

function verifyNomiqWebhook(
  rawBody: Buffer,
  signatureHeader: string,
  webhookSecret: string
): boolean {
  const expected = createHmac("sha256", webhookSecret)
    .update(rawBody)
    .digest("hex");

  const trusted = Buffer.from(`sha256=${expected}`, "utf8");
  const received = Buffer.from(signatureHeader, "utf8");

  // Use timingSafeEqual to prevent timing attacks
  if (trusted.length !== received.length) return false;
  return timingSafeEqual(trusted, received);
}