GoRunner docs
Search or askSearch⌘K

Security

What the installation guarantees about the embed, and what your side must do.

Embed · Self-hosted with an Embed license

What the installation guarantees

No cookies
The embed signs in with a token held in the frame’s memory. No cookie is set or read, and an embed token is never accepted from one. Blocking third-party cookies, as Safari does, changes nothing.
Short, single-use credentials
A login code works once, within 60 seconds. A session lasts 30 minutes and is renewed by swapping it, for up to 12 hours after the code. Only hashes of keys, codes, sessions and tokens are kept.
Access ends at once
Removing a person, changing their role, suspending or deleting an account, and revoking a key end the sessions they affect, open streams included.
Framed only where you allow
The embed document names only the page it was opened for, when that page is on your allowed websites or its customer’s own. Neither list is published: a page learns only whether it is allowed itself. The installation sets this policy itself; a proxy only has to leave it alone. The rest of the installation can’t be framed by another site, and the AI app consent page never.
Exact origin, exact window
The frame and the SDK read messages only from each other’s exact origin and window, and never post to "*". Every message is checked before it is read, and none can turn anything on.
Enforced on the server
Switches, the app list, roles and the account boundary are checked on every request. Hiding something in the embed is never the protection. A token is held to the same checks.
Steps stay off your network
No workflow step ever reaches the cloud metadata service. Your private network, and the installation’s own database and Redis, stay closed unless the operator lists them in WORKFLOW_PRIVATE_NETWORKS. Each connection is checked as it is made, so a name that later points elsewhere, or a redirect, can’t get round it. Before v2026.10.4 a step could reach any address the worker could: update before customers build. See Outbound access.
One customer can’t starve another
Login codes are limited per person, per key and per account, and each account can have its own runs at once.
A tight frame
The embed document runs scripts only from the installation, and frames nothing. The SDK sandboxes the frame: scripts, its own origin, forms, popups that leave the sandbox, and downloads. It never navigates your page. It may only write to the clipboard.
Safe sign-ins
A connection’s sign-in is tied to the window that started it, with PKCE. An AI app’s sign-in reaches your page with only a request id, is tied to the browser that started it, and its link works once: opened in another browser, it is spent. Its consent page refuses any other site.
Everything recorded
Every partner API call leaves a row in the account’s audit log, without its body, except reading an AI app sign-in request. Your staff read it in Platform › Audit log, filtered to the organization. There is no partner API for it.

Your checklist

Keep the key on your server
Never in a page, a mobile app, a repository or a log. A key per environment lets you revoke one alone.
Limit where the key works
Give the production key Allowed from: your servers’ addresses. A leaked key is then useless anywhere else.
List websites exactly
Prefer an exact address to a wildcard. Never leave a staging or local address on the production list. A customer’s own domain goes on that customer’s list, through the API.
Make codes only for the person asking
Your login-code route trusts your own session. Make a code only for an account the person belongs to, at the role they should have.
Throttle your login-code route
GoRunner allows 20 codes a minute for one person. Stop a page that reloads in a loop at your route first.
Never put a code in an address
Nor in a log, an error report or analytics. Hand it straight from your server’s answer to getCode.
Give the least role
viewer to look, operator to run, editor to build.
Switch off what isn’t needed
For everyone, one account, or one sign-in.
Allow the installation in your CSP
In your page’s Content-Security-Policy: script-src for /embed.js, frame-src for the frame, connect-src for the check the SDK makes first. Don’t block clipboard-write.
Keep steps off your network
Leave WORKFLOW_PRIVATE_NETWORKS empty, or list only what customers’ workflows should reach. Never all.
Check every notification
Its signature, its timestamp, and its webhook-id. See Check a request is genuine.
For AI app sign-in
Do the four duties, every time.
Keep two platform admins
So a lost phone never locks your staff out of the Platform.

If a partner key leaks

Danger Revoke it. Rotating isn’t enough: the sessions the old key opened carry on, and the AI apps it signed in keep working.

  1. Make a new key on Platform › Partner keys, and switch your servers to it.
  2. On the leaked key, choose Revoke…. Requests with it fail at once, everyone it signed in is signed out, and the AI apps it signed in are disconnected. The dialog says how many.
  3. Check each account’s websites (List an account’s websites) and its aiSignIn.address (List accounts). A key can change both, and its changes stay after it is revoked.
  4. Read Platform › Audit log for what the key did. A changed sign-in address is recorded without its query.
How do I end every AI app at once?

On Platform › What customers get, open Developers and press Disconnect all AI apps, with your two-factor code. People must sign in again to connect. Turning a switch off only pauses them.

Checked against 12d85b3b