Skip to main content

API Key ↔ string password to access Online API

bearer

should Encrypt API Key & not stored as Plaintext

Public Key​

API Key to connect Frontend to Online API, safe to expose to public

Secret Key​

API Key to connect Backend to Online API, access to sensitive internals/accounts - unsafe to expose

Scoped API Key​

to restrict API Key to specific record scopes

ACLs​

Access Control Lists

References​

  1. Public Key ↔ API Key to connect Frontend to Online API, safe to expose to public

  2. Secret Key ↔ API Key to connect Backend to Online API, access to sensitive internals/accounts - unsafe to expose

  3. Scoped API Key ↔ to restrict API Key to specific record scopes

  4. Bootstrap Key ↔ API Key with root-level control for init setup only | ticking time 💣