One API key
The API key scopes MCP and API actions to one account. The full key is shown once, and Coldrig keeps only a hashed copy, never a readable one.
Trust by inspectable boundaries
Agent-operated. Server-governed.
Coldrig gives an agent useful authority inside one account while keeping essential safety rules below the model layer. This is the current trust model—not a certification claim.
Control layers
Four boundaries that matter.
A trustworthy agent product cannot rely on a good prompt alone. Identity, separation between accounts, spend, and sending behavior need firm enforcement and human visibility.
Browser session
You sign in to the dashboard with an emailed link or your API key. Your browser then holds an HTTP-only session, so page scripts do not routinely handle your key.
Server guardrails
Suppression, stop-on-reply, limits, idempotency, and health-based state transitions are service rules, not agent promises.
Scoped data paths
Every dashboard and tool request is checked against the signed-in account first. Customers do not share a sender reputation pool.
Visible control
The owner sees health, campaigns, replies, setup, and billing projections. Self-serve billing (Stripe live mode) is active — $49 a month covers the first 3 mailboxes and each extra mailbox is $5 a month — and every real purchase is recorded against a monthly spending limit on the supplier account as it runs, and unusual spend goes to a support check.
No hidden claims
A lost API key cannot be read back, and there is no compliance certification claim.
Your responsibilities
Secure the credential. Govern the agent.
- Keep your API key out of source controlUse a password manager or client-level secret environment.
- Review tool accessInspect the 34 available tools before approving write actions.
- Try test mode firstTest mode has no card on file, cannot spend, and cannot send — try out failure handling and repeated requests there before you go live. Your API key stays the same when you go live.
- Rotate after suspected exposureAPI keys are not recoverable in plaintext. You can rotate yours yourself: open Settings in the dashboard and choose Rotate API key. The old key stops working immediately and every dashboard session is signed out.
Responsible disclosure
Report privately.
Email security@coldrig.dev with impact, reproduction steps, and a safe proof. Do not access other customers' accounts, run destructive tests, or include live secrets. We do not publish a bounty or guaranteed response SLA. If that address bounces, open a minimal, non-sensitive GitHub issue asking for a private contact path.