Security
Keys, secrets and what to check before running a public worker.
Keys
| Key | Where it lives | If it leaks |
|---|---|---|
| Your main wallet | Your wallet app | It signs your rules; treat it as you would any wallet |
WORKER_KEY | Only the worker's environment | Someone can act as the worker and spend its test GLM. Fund it with little, and rotate it |
TG_TOKEN | Only the worker's environment | Someone can send messages as the bot. Revoke it in BotFather |
ARKIV_ACCESS_KEY | Server environments only | Someone can spend your quota. Replace it in the Arkiv hub |
Never commit a .env file, never pass a key through a VITE_ or NEXT_PUBLIC_ variable, and treat
any key that was ever committed as leaked.
What a public worker refuses
- Code from rules. Only the four actions run.
- Private addresses. A webhook URL that resolves to localhost, a private range or a link-local address is refused, so a public rule cannot make your worker call into your network.
- Plain chat IDs. Telegram rules must carry a sealed chat; the worker opens it with its own key.
- Runaway work. Webhook and Telegram actions stop after 30 seconds across all attempts.
Receiving webhooks
Verify every call with verifyWebhook against workers you trust, de-duplicate on the signed event,
and never put a secret in the URL. See Webhooks.
Status
OpenTrigger 0.1 is testnet software and has not had an outside audit. See the threat model.