DevelopersPre-alpha

API keys

Creating and using API keys for POST /api/rpc.

Creating a key

Keys are created for a user (web action stores a one-time raw key in an HttpOnly flash cookie). The raw secret is shown once. Store it in a secret manager.

Using a key

Terminal

shell

$curl -s http://localhost:8080/api/rpc \$-H 'Content-Type: application/json' \$-H 'X-API-Key: sk_YOUR_KEY' \$-d '{$"model": "my.module",$"method": "search_read",$"args": [[], ["id", "name", "active"]],$"kwargs": {"limit": 50, "offset": 0}$}

Header forms: X-API-Key: sk_... or Authorization: Bearer sk_.... Session cookie auth remains available for browser clients.

Compile and run

Terminal

shell

$make run$curl -s http://localhost:8080/api/health

What not to do

Do not log raw API keys.
Do not share one key across unrelated integrations with different privilege needs.

Next step

RPC catalogue in JSON-RPC API, or Isolation model.