# Provider adapters

Implement each provider only against its official API and current documentation. Keep endpoints, credentials and request signing server-side. Normalize provider responses into PromptVault job states: `queued`, `running`, `completed`, `failed`, `cancelled`.

Never expose API keys in `index.html`, client JavaScript, localStorage, query strings or analytics events.
