Security
This page states what Farbeam does with secrets and what you must do on your side. It makes no claim of certification or audit, because Farbeam has none.
#API keys
| Fact | Detail |
|---|---|
| Format | fbk_ plus 48 hex characters, made from 24 random bytes |
| Stored form | SHA-256 hash only. The value cannot be read back. |
| Shown | Once, in the POST /keys response |
| Sent as | Authorization: Bearer <key> or X-API-Key: <key> |
| Query string | Not accepted |
| Revoke | DELETE /keys/{id} with a session, which leaves rules on. DELETE /me with the key, which turns off the rules that key created. |
| Rotation | Sign in, create a new key, switch your code, and revoke the old key |
| Expiry | None |
What to do:
- Keep keys in environment variables or a secret manager.
- Do not put a key in browser code. CORS is open on
/api/v1, so a key in a public page can be used by anyone who reads it. - Use one key per service, so that one revoke does not stop everything.
- Do not paste a key into tickets, logs or chat.
The playground keeps a pasted key in the page only, and scripts on the page can read it. The site's strict CSP blocks inline and third-party scripts, and no third-party analytics run on the site.
#Wallet sign-in
| Fact | Detail |
|---|---|
| What you sign | One text message with the site name, your address, a nonce and an expiry. See authentication. |
| Challenge | 5 minutes, one use, deleted on the first attempt |
| Check | Ed25519 signature against the Solana address |
| Session token | 32 random bytes in the fb_session cookie. Stored as a SHA-256 hash. |
| Cookie | HttpOnly, SameSite=Strict, Path=/api, and Secure over HTTPS |
Read the message before you sign it. It must say that it sends no transaction, and it must name farbeamlabs.com. Sign-in gives no access to funds. A wallet that shows a transaction rather than a message is not the Farbeam flow, so reject it.
#Webhook secrets
| Fact | Detail |
|---|---|
| Format | fbs_ plus 48 hex characters |
| Stored form | Plain text in the database, because the server needs it to compute each HMAC |
| Shown | Once, in the create response |
| Rotation | No endpoint today. Delete the rule and create a new one. |
If a secret leaks, delete the rule at once. A stolen secret lets someone forge events to your endpoint, but it gives no access to your key.
What your receiver must do:
- Verify each signature on the raw body, with a constant-time compare.
- Reject timestamps older than 5 minutes.
- Deduplicate on
rule_idanddata.uid. - Treat event fields as untrusted text. A token symbol comes from a contract, and anyone can choose it. Escape it before you show it, and never run it.
- Do not treat a webhook as a reason for an automatic transaction.
#Outbound webhook protection
The server treats your URL as untrusted.
| Control | Detail |
|---|---|
| Scheme and port | HTTPS on port 443 only |
| Hostname | Must be a public name. IP addresses, localhost, .local and .internal are refused. |
| Credentials in URL | Refused |
| Address check | DNS is resolved at send time. Private, loopback, link-local and similar ranges are refused. |
| Pinning | The connection uses the address that was checked |
| Redirects | Not followed |
| TLS | Certificates are verified |
| Timeout | 6 seconds |
#HTTP protections
| Item | Value |
|---|---|
| CSP on pages | Strict, with no inline scripts and no third-party sources |
Referrer-Policy | no-referrer |
| API caching | no-store |
| Request body cap | 32,768 bytes |
| SQL | Parameterized statements |
| Beamline | Parsed by its own grammar, never run as code |
| Fonts | Self-hosted |
#Third-party calls
Lookups send the address, token or transaction you ask about to the sources that serve it, such as RPC providers, DexScreener, GoPlus, RugCheck and CoinGecko. Your IP and your key are not sent. A source sees the Farbeam server as the caller.
#What Farbeam never asks for
Farbeam never asks for a seed phrase or a private key, and it never asks you to sign a transaction. The only signature it asks for is the sign-in message on the console. The API has no endpoint that sends transactions. Reading data needs no wallet. If a message claiming to be from Farbeam asks for more than this, it is not genuine. Contact is only through contact@farbeamlabs.com and @FarbeamX.
#Reporting a problem
Send security reports to contact@farbeamlabs.com, with the steps to reproduce and any request_id. Do not include real secrets. There is no bug bounty.
Do not test against other people's data or keys, and keep your tests within the rate limits. See acceptable use.