Prioritizing publishable tokens

[PeterShinners]

I always knew it would a good idea for an account to create publishable authentication tokens for Thumbrella Cloud. Now that I've got some compelling demos coming together, I'm realizing how critical this is for interactive apps being posted online. Also now that I'm sitting directly in front of this I finally have a good concept of what controls someone would want over their publishable keys

• cors header restrictions
• origin restrictions
• media domain/url restrictions (regexes)
• request rate throttling
• usage quota limits
• optional integration with "invisible captcha like Turnstile

Not all of these provide bulletproof security, but each one does eliminate avenues of abuse. (Some more than others) They are also easy to understand and administer.

The captcha integration will likely come at a later date. It depends how easily and reliably the other controls come come together.

[PeterShinners]

Just rolled this out. This is really powerful and cool. The form for managing all this is way too scary and intimidating, but it's a starting point.