Builders Program

Build with us for a whole month. Unlimited usage and add-ons, weekly calls and your own Slack channel.

Learn more
Polymorfa

Security

Keys that do one job, a trail for every change

Scoped credentials, signed webhooks, an exportable audit log and data kept in its region. On from your first request.

Start buildingRead the Security guide
Permissions to scope a key
51
Credential kinds, each with its reach
3
HMAC on every webhook
SHA-256
Privacy laws in our DPA
5

Access

Least privilege by default.

Give each integration its own key with only the permissions it needs. Browsers get short-lived tokens with rules.

Three credential kinds. Team keys, project tokens and client tokens never stand in for one another. Service accounts outlive the person who made them.
Rules for the browser. Client tokens carry allowed actions, origins, a rate, a daily maximum and a conversation window.
Console sign-in. Passkeys, authenticator apps with recovery codes and email codes. See every session and end any of them.

Trail

Know who did what, and prove it.

Signed deliveries, an audit log with before and after values, and alerts when something looks wrong.

Signed webhooks. HMAC-SHA256 over the raw body on every delivery, in our format or Meta's. Rotate the secret with an overlap.
Audit log. Filter by actor, action, source, result or date. See what changed and export it as CSV or JSON.
Incidents and alerts. Exposed keys, new sign-ins and a key's first use reach you by email and as incidents to acknowledge.

Residency

Your data stays in its region.

A Swiss company with data in the EU and Brazil, and more regions coming soon.

Where data lives. Console data and secrets stay in the EU. Messaging runs in the region assigned to each number.
Privacy law, covered. One agreement for Swiss, EU, UK, Brazilian and Indian law, with a public subprocessor list.
Read the DPA

In your code

Security from your own code.

Verify deliveries, read the audit log and handle incidents from the SDK, the CLI or plain HTTP.

Security guideSDK docsCLI docs
app/webhooks/route.ts
import { webhooks } from "@polymorfa/sdk";

export async function POST(request: Request) {
  const event = await webhooks.verify({
    body: await request.arrayBuffer(),
    signature: request.headers.get("x-webhook-signature") ?? "",
    secret: webhookSecret,
  });
  // A bad signature throws before you read the payload.
  await handle(event);
  return new Response(null, { status: 204 });
}

API surface

The Security API.

Use client tokens, read the audit log and handle incidents. Manage organization keys and project tokens in the Console.

API key docs

Credentials

  • POST/platform/client-tokensMint a client token
  • PUT/platform/sessions/{session}/client-rulesSet a number's client rules

Audit and incidents

  • GET/platform/auditThe team's audit log
  • GET/platform/incidentsSecurity incidents
  • POST/platform/incidents/{incidentId}/acknowledgeAcknowledge an incident
  • GET/platform/projects/{projectId}/request-logsEvery API request, with logs:read

Webhook secrets

  • POST/platform/webhooks/{webhookId}/secret-rotationsRotate a signing secret with an overlap

Start with a free number

Your first real number is free. Add more numbers on Pay-As-You-Go.

Start buildingSee pricing