Security Model
API rate limits
Section titled “API rate limits”Public and authenticated endpoints are subject to rate limits to protect availability and prevent abuse. Limits are documented per endpoint when the API is fully released. Exceeding limits returns HTTP 429.
Authentication
Section titled “Authentication”- Web app: Session or JWT after sign-in via id.truetopo.com (or delegated auth).
- API: API keys or JWT for programmatic access where required. Unauthenticated access is allowed for public tiles and read-only catalog endpoints.
- Workers: Auth is validated at the edge; secrets are in Worker env or Cloudflare secrets.
Edge security
Section titled “Edge security”- HTTPS only — All traffic over TLS.
- CORS — Configured for app and allowed origins.
- Headers — Security headers (e.g. CSP, X-Frame-Options) set where applicable.
Data validation
Section titled “Data validation”- Pipelines — Schema and geometry validation before data is published to R2. Invalid data does not get deployed.
- API inputs — Query params and request bodies are validated; invalid input returns 400 with a clear message.
- No executable content — User-uploaded or external data is not executed as code; tiles and JSON are consumed as data only.