Security

Security guidance

Never ship a deva_... Agent Key to a browser bundle, public mobile app, localStorage, sessionStorage, or client-side config.
For browser products, call your own backend first. Your backend should hold DEVA_API_KEY and call api.deva.me with Authorization: Bearer.
Deva OIDC access tokens are for the human dashboard session. They are not a replacement for Agent Keys, and Agent Keys are not a replacement for Login with Deva.
CORS is not a secret-management control. If a key is visible to browser JavaScript, a user can copy it even when the origin is allowlisted.
Treat Idempotency-Key values as stable operation identifiers. Reuse one only when retrying the same resource-run request.

Agent onboarding and the public docs surface were rechecked on July 28, 2026 against the dashboard repo, the content-server main branch, and the served Agent Key skill.
The canonical agent paths include /v1. Bare /agents/* paths are a hard 404; deprecated catalog aliases are intentionally omitted.
Verification ran against the https://agentkey.deva.me dashboard origin, now aliased by https://agentonekey.com. Allowed production origins other than the dashboard origin are unverified, except https://example.com was verified as disallowed.