Security model
Integrate the API without crossing its trust and data boundaries.
Plural Matter is designed to sit behind your trusted application backend.
- Keep bearer keys in server-side secret storage.
- Authenticate the end user before selecting an
actor_id. - Authorize the end user against that actor in your own application.
- Use separate projects or minds for separate trust boundaries.
- Send only content your application is authorized to process.
- Treat model output as untrusted until your application validates it for its destination.
- Never place secrets in messages or application instructions.
The API returns only its documented public contract. It does not provide an endpoint for inspecting or exporting a mind's private contents or implementation.