Documentation/Developers
Back
  • Getting started
    • Frontends and app types
    • Environments and endpoints
  • OAuth clients
    • Client ID and secret
    • Redirect URIs and start URL
    • Secret rotation
  • Login with appsolut
    • Authorization code flow
    • Tokens and claims
    • Frontend role
    • Sign-out
    • Revocation and issued tokens
    • Token endpoint errors
  • Frontend keys
    • Issue and store a key
    • Send a key
    • Rotate and revoke
  • Members API
    • Eligibility from a backend
    • The signed-in member
    • Results, rate limits and errors
    • Is an applicant an eligible member?
    • The signed-in frontend user's membership
  • appsolut register API
    • Implement the API
    • Connect and test
    • Verify a member with their challenge code
    • List every member
    • The status of several members
    • The status of one member
    • The person data of several members
    • The person data of one member
    • The claims of several members
    • The claims of one member
    • Health check

Issue and store a key

Issuing a frontend key in the Studio, and keeping it on your server.

Studio roles: "Owner", "Administrator", "Frontend manager".

Issue a key

  1. In the Studio, open "Frontends" and the frontend.
  2. On the "Keys" card, click "Issue key".
  3. The dialog "Your new key" shows the "Frontend key". Copy it with "Copy" and store it in the frontend's backend.
  4. Close the dialog with "I have stored the key".

The key is shown only once. Once the dialog is closed, it cannot be shown again: the Studio keeps only its first characters. If you lose it, issue a new key and revoke the lost one.

A frontend has at most two active keys. With two, the Studio says "This frontend has two active keys", and you revoke one before you issue another.

If the Studio user signs in with multi-factor authentication, issuing and revoking keys needs a session confirmed with their second factor.

What the card shows

For each key, the "Keys" card lists its prefix ("Key"), who created it ("Created by"), when ("Created"), when it was "Last used" (recorded at most once a minute; "Never" for a key not used yet) and its "Status". Use "Last used" to see whether an old key is still in use before you revoke it.

Store it

  • Keep the key in your backend's secret store or environment, like a database password. It belongs to one frontend and one environment: a test environment's frontend has its own key.
  • Never put it in a browser, a single-page app or a mobile app bundle. Anyone who can read it can call the Members API as your frontend. The Members API answers no CORS, so a browser could not use it anyway.
  • Never log it. Log the prefix if you need to tell keys apart.