API keys

Your app identifies its project with an API key, sent in the x-vaif-key header. Keys are listed on Security > Credentials in the console, next to the project ID. Each key belongs to one environment.

The project’s two keys

Every new project gets a pair, and the prefix tells you what each key can do:

Key	Prefix	Row rules	Use for
Publishable	vk_pub_	Apply	Browser and mobile apps; safe in bundles
Secret	vk_srv_	Bypassed	Server-side code only

A secret key reads and writes every row, so it never belongs in a browser or app bundle, and the API refuses it from browser origins. @vaifstudio/client also prints a console warning when it sees a vk_srv_ key in a browser. See Key types.

More keys

Choose Create key on Security > Credentials to add a key. You choose:

• the type: Publishable, for browsers and apps, or Secret, for servers;
• the scopes, which say what the key can reach;
• when it expires, or no expiry.

Scope	Allows
crud	The data API (/v1/data/...)
storage	Storage
functions	Invoking functions
realtime	Realtime connections

A publishable key you create starts with vk_pub_ and can be revealed again later; each reveal is recorded in the audit log. A secret key you create starts with vaif_ and is shown once, when it is created. Row rules apply to both; only the project’s own vk_srv_ key bypasses them.

You can also create keys with vaif keys generate or POST /projects/{projectId}/api-keys.

Using a key

import { createVaifClient } from "@vaifstudio/client";

// Browser or mobile app: the publishable key
const vaif = createVaifClient({
  baseUrl: "https://api.vaif.studio",
  projectId: process.env.VAIF_PROJECT_ID,
  apiKey: process.env.VAIF_PUBLISHABLE_KEY,
});

// Server only: the secret key
const admin = createVaifClient({
  baseUrl: "https://api.vaif.studio",
  projectId: process.env.VAIF_PROJECT_ID,
  apiKey: process.env.VAIF_SECRET_KEY,
});

Over HTTP:

curl "https://api.vaif.studio/v1/data/$VAIF_PROJECT_ID/posts" \
  -H "x-vaif-key: $VAIF_PUBLISHABLE_KEY"

Rotating and revoking

Rotate or revoke a key from its menu on Security > Credentials, or with POST /projects/{projectId}/api-keys/{keyId}/rotate and POST /projects/{projectId}/api-keys/{keyId}/revoke and a console access token. Rotate a key whenever it may have been exposed.

Good practice

• Keep keys in environment variables, never in source control.
• Use the publishable key, with row rules, in client code.
• Give each extra key only the scopes it needs, and an expiry.
• Rotate a key you think has leaked, then check the project’s audit log under Security > Audit.