LexelanePractical protections.
Keys and sessions
API keys and session tokens are stored as hashes. Provisioned accounts use salted password hashes and sign-in limits; passwords can be changed in Account settings. Optional Google sign-in validates state, PKCE, nonce, issuer, and audience. Browser account changes require a matching Origin.
Budget checks before generation
An atomic reservation checks your balance, key budget, account status, and shared limits before a model call. Uncertain charges remain auditable and can be reconciled.
Payment verification
Payment events require signature verification, order and amount checks, provider confirmation, and duplicate protection before balance is credited.
Report an issue
Contact support with the affected request ID and a concise description. Do not include secret keys or sensitive request content.