API Key Strategy

To integrate with third-party APIs or services, you might need a credential that identifies a request as a specific user without logging in. In FrogBot, API keys come from the API keys plugin. Auth collections don’t have a built-in API key option. The plugin adds an api-keys collection whose keys belong to users of an auth-enabled collection. A user can own several named keys, and each key can be revoked on its own. Keys are stored as hashes, and the plaintext key is shown only once, when it’s created.

import { apiKeysPlugin } from '@frogbotai/plugin-api-keys'
import { buildConfig } from 'frogbot'

export default buildConfig({
  collections: [
    {
      slug: 'users',
      auth: true,
      fields: [],
    },
  ],
  plugins: [apiKeysPlugin()],
})

A request that sends a key authenticates as the key’s owner and goes through the same Access Control as any other request from that user. Send the key as a Bearer token:

const response = await fetch('http://localhost:3000/api/pages', {
  headers: {
    Authorization: `Bearer ${YOUR_API_KEY}`,
  },
})

With the AI policy plugin, each key can also have its own model list and monthly cap, inside its owner’s. For the X-API-Key header, custom header names, key prefixes, and access options, see the API keys plugin.

Start here

Basics

Managing Data

Features

Ecosystem

Deployment