◆ ENCRYPTED AT REST
Your key is encrypted using AES-256-GCM before storage.
The plaintext key is never written to disk or database.
◆ SERVER-SIDE ONLY
Your key is submitted once over HTTPS and never returned
to your browser. All Torn API calls are made server-side.
◆ SESSION TOKENS
After verification a secure session token is issued.
Your key is not stored in your browser, cookies, or local storage.
◆ MINIMAL USE
Clients: key is used only to verify your identity at login.
Mercs: additionally used server-side to verify hits on contracts.
◆ NO THIRD PARTIES
Your key is never shared with or exposed to any third party.
It communicates only with Torn's official API.
◆ REVOCABLE AT ANY TIME
Delete your API key on Torn to immediately revoke access.
Your DEADBOLT account and balance are retained.