Security Architecture

​

Authentication

​

Supported Methods

​

Email Normalization

# Normalization rules:
# 1. Trim whitespace
# 2. Lowercase
# 3. Gmail: Remove dots and plus-addressing

"John.Doe+spam@gmail.com" → "johndoe@gmail.com"
"user@Company.COM"        → "user@company.com"

​

Multi-Tenant Isolation

​

Isolation Model

user
 └── belongs to → organization (via member table)
                      └── owns → agents, phone numbers, API keys,
                                  call logs, billing data

1. Every DB query must filter by organizationId
2. Session context includes activeOrganizationId
3. API keys are scoped to a single organization
4. Cross-tenant data leaks are prevented at the query level

​

Role-Based Access Control

​

Credential Encryption

​

What’s encrypted

​

Fernet Encryption

# Encryption
from cryptography.fernet import Fernet

def encrypt(plaintext: str) -> str:
    f = Fernet(FERNET_KEY)
    return f.encrypt(plaintext.encode()).decode()

def decrypt(ciphertext: str) -> str:
    f = Fernet(FERNET_KEY)
    return f.decrypt(ciphertext.encode()).decode()

​

API Security

​

API Key Authentication

• Keys are stored as hashed values in the database (not plain text)
• Keys use sk_live_ prefix for production, sk_test_ for sandbox
• Invalid or revoked keys immediately return 401 Unauthorized

​

Rate Limiting

​

CORS

• Only requests from studio.talkifai.dev are allowed by default
• Marketing site API has additional API key + origin validation (dual authentication)

​

LiveKit Token Security

// Token generation rules
1. Validate roomName format:
   - Valid: "agent_{agentId}_{timestamp}_{random}"
   - Valid: "demo_{identifier}"
   - Invalid: anything else → rejected

2. Check organization membership before granting token

3. Token TTL: 5 minutes (short-lived)

4. Permissions granted:
   - roomJoin: true
   - canPublish: true (user can send audio)
   - canSubscribe: true (user can receive audio)

​

Security Checklist for Developers

• Store API keys in environment variables, never in code
• Use HTTPS for all webhook endpoints
• Verify webhook signatures before processing events
• Rotate API keys every 90 days
• Use the test environment (sk_test_) for development
• Never log API keys, SIP passwords, or credentials
• Monitor API key activity for unusual patterns