Security
Auth modes, CORS, domain restrictions, and rate limits on public APIs.
Each API owns its own security settings. Configure them in the console under the API’s security panel.
Authentication modes
| Mode | Behavior |
|---|---|
none | Public reads/writes allowed (still subject to permissions, CORS, domains, rate limits, captcha) |
api_key | Every request must include a valid key |
See Authentication for header formats.
CORS
Configure allowed origins on the API. Browser clients must send an Origin that matches. Advanced CORS options are plan-gated (Pro and above).
Domain restrictions
Optionally restrict which browser origins may call the API. Requests from disallowed origins are rejected.
Rate limits
Per-API rate limit profiles (for example 10/10s, 100/60s, 1000/60s). Higher profiles require a plan with higher rate limits enabled. Exceeding the limit returns 429 RATE_LIMITED.
Captcha
Optionally require Cloudflare Turnstile on create, update, delete, or calculate. See Captcha.
Webhooks
Paid plans can subscribe to row mutation events. See Webhooks.