| What | How it's stored |
|---|---|
| Social account tokens and app passwords | Encrypted with AES-256-GCM |
| Webhook endpoint URLs | Encrypted with AES-256-GCM |
| Your own AI provider keys | Encrypted with AES-256-GCM |
| API keys | Only a SHA-256 hash is kept. We can't show a key again after creation |
| Webhook signing secrets | Revealed only to people who can manage roles |
Access
- API keys and webhooks belong to one workspace and can't reach any other.
- Only the Owner, or a custom role with the right management permission, can create keys or webhooks.
- Public API and MCP requests are limited to 120 per 60 seconds per key.
- Sign-in and other public forms are rate limited to slow down password guessing and spam.
Connected platforms
You can disconnect any social account from Settings → Connections at any time. When someone removes our access from their Facebook or Instagram settings, we erase the stored tokens and mark the connection as disconnected.
Report a problem
Found a security issue? Email support@aeroreply.com with the details. We read every report.
Was this helpful?
Ship on-brand posts in minutes
Back to documentationAI content, scheduling, engagement and a full marketing suite — free to start.
Start free
