REST APIs
High-performance REST endpoints for AI, Media Downloaders, Movies, News, Crypto and more.
Heavstal Tech Documentation
Building Tomorrow's Web, Today - Explore the Heavstal Tech ecosystem.
Heavstal Docs
OAuth2 & OIDC
Learn how to Integrate “Sign in with Heavstal Tech” into your applications using standard OAuth2 & OpenID Connect.
Packages
Enterprise-grade packages including @heavstal/api, HT-Baileys, and @heavstal/auth.
Automation Bots
Docs for our WhatsApp and Telegram automation bots.
Ecosystem Guide
Learn how to navigate our platforms and manage applications.
What’s New
The latest features and improvements shipping across Heavstal Tech.
Aug 24, 2026
Granular Security Controls for Your API Keys
We are introducing a major expansion to API security with the launch of Web Application Firewall (WAF) controls for API keys.
The new security layer gives developers granular control over how their API credentials can be used, enabling them to define trusted sources, authorized clients, and permitted API capabilities for each individual key.
The API Key WAF is designed to introduce additional security for keys.
Security Layer for Every API Key
Developers can create up to five independent API keys, with each key capable of having its own security configuration.
The WAF provides four primary authorization controls:
IP Address Authorization
Organizations can restrict an API key to specific IP addresses or network ranges.
Once configured, requests originating from an unauthorized address are automatically rejected.
CIDR notation is also supported, allowing organizations to authorize entire network ranges rather than maintaining individual IP addresses.
For example, authorizing 1.1.1.0/24 permits requests from addresses within that network range while rejecting requests originating outside it.
Origin Authorization
API keys can be restricted to authorized origins.
Developers and Organizations can define the domains permitted to use a particular API Key, providing an additional security boundary for keys associated with web applications and specific environments.
Requests originating outside the configured authorization policy are automatically rejected.
User-Agent Authorization
Developers and Organizations can establish an explicit User-Agent policy for individual API keys.
Custom User-Agents can be authorized for internal applications, services, and automated clients. Requests that do not satisfy the configured policy can be rejected at the API boundary.
API Endpoint Authorization
We also introduced endpoint-level authorization for API keys.
Rather than granting a key access to the entire API surface, developers can select the specific APIs and endpoints that a key is permitted to access.
For example, a credential intended for movie APIs can be restricted exclusively to those APIs. If that credential is subsequently used to access an unauthorized AI endpoint, the WAF will reject the request.
This provides a practical implementation of the principle of least privilege, limiting credentials to the capabilities they actually require.
Request Auditing
Security controls require visibility.
The dashboard now provides an audit log for blocked API requests, including the reason each request was rejected.
This allows developers and security teams to identify unauthorized access attempts, diagnose configuration issues, and understand how their API security policies are being enforced in production.
Defense in Depth for API Credentials
The introduction of API Key WAF controls represents a significant expansion in API security.
Developers and Organizations can establish additional conditions that must be met before a request is accepted.
A single key can therefore be constrained by:
- Source IP — where the request originates
- Origin — which domain is making the request
- User-Agent — which client is making the request
- API permissions — which APIs the key can access
These controls can be configured independently for each API key, providing organizations with greater control over credential usage and reducing the potential impact of exposed or misused credentials.
Available Now
The API Key WAF is available now through the platform.
Jun 25, 2026
Introduction To The New Heavstal Invoice System
Billing & Invoicing
We’ve launched a new Billing & Invoicing system across Heavstal Tech.
Payments made through any Heavstal Tech service are now automatically recorded in your billing history, with invoices available directly from the Billing page.
Make a payment through any of our services and head to your Billing page to view the generated invoice.
Apr 19, 2026
Notice of Domain Migration.
We've officially migrated to a new domain.
All users, developers, and applications currently using our previous domain are advised to update their configurations to use our new official domain:
Please ensure that any application configurations, integrations, API references, or other domain-dependent services are updated accordingly to maintain uninterrupted access to Heavstal Tech services.
