AI Chatbot Security: 2FA, OAuth, Headers and More

Why Does Security Matter in AI Chatbots?

AI chatbots handle sensitive information: internal documents, customer data, business configurations. A security breach doesn’t just expose data — it can generate manipulated responses that damage trust in your brand.

Multi-Factor Authentication (2FA/TOTP)

The first line of defense is ensuring that whoever accesses the admin panel is really who they claim to be.

How does TOTP work?

1. The user activates 2FA from their account settings
2. A TOTP secret is generated and a QR code is displayed
3. The user scans the QR with an app like Google Authenticator
4. On each login, besides the password, they enter the 6-digit code that changes every 30 seconds

Benefits:

• Protects against stolen or leaked passwords
• Open standard (RFC 6238), compatible with any TOTP app
• Doesn’t depend on SMS (vulnerable to SIM swapping)

Google OAuth: Delegated Authentication

OAuth allows users to sign in with their Google account, eliminating the need to manage passwords:

• Less friction: One click to enter
• Delegated security: Google handles authentication, including its own 2FA
• No passwords to manage: Eliminates risks of weak or reused passwords

HTTP Security Headers

HTTP headers are an invisible but critical layer of protection:

API Key Hashing (SHA-256)

API keys are the bridge between your application and the chatbot. Citai never stores the key in plain text:

1. Generation: A key is created with sk- prefix + 32 random bytes
2. Show once: The full key is shown only at creation time
3. Storage: The SHA-256 hash of the key is stored in the database
4. Validation: Each request computes the hash of the received key and compares it with the stored one

If the database is compromised, the hashes are useless to the attacker — they cannot be reversed to the original key.

Rate Limiting with Redis

Rate limiting prevents abuse and denial-of-service attacks:

• Sliding window with Redis sorted sets — precise and efficient
• Configurable per API key — different limits per plan
• Fail-open design — if Redis goes down, requests pass through (no service blocking)
• Informative headers — X-RateLimit-Remaining and X-RateLimit-Reset

HMAC Signatures for Webhooks

When Citai sends events to your server (escalations, negative feedback, etc.), each request includes an HMAC-SHA256 signature:

• Your server verifies the signature with the shared secret
• Prevents third parties from forging events
• Includes timestamp to prevent replay attacks

Conclusion

Security in AI chatbots is not optional — it’s fundamental. Each layer of protection (2FA, OAuth, headers, hashing, rate limiting, HMAC) reduces a different attack vector. Citai implements all these layers so you can focus on what matters: delivering accurate answers to your users.

Protect your chatbot with enterprise security. Get started with Citai →