Add Api Token docs#971
Open
Piroddi wants to merge 1 commit into
Open
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
📝 WalkthroughWalkthroughThis PR updates Security configuration documentation across both HyperIndex and HyperIndexV2 hosted service guides. A new Security section replaces the prior standalone IP Whitelisting documentation, clarifying that security rules apply per indexer (project) rather than per deployment, documenting paid-plan availability, and introducing API Key Authentication with bearer token header usage examples and 401 Unauthorized response details. ChangesSecurity Configuration Documentation
🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
MJYoung114
approved these changes
Jun 12, 2026
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/HyperIndex/Hosted_Service/hosted-service-features.md`:
- Around line 63-80: The doc currently recommends using a shared API key for
"browser-based dApps and frontends" which is unsafe; update the text around the
"recommended option for browser-based dApps and frontends" and the
Authorization/Bearer example to explicitly prohibit embedding the API key in
client-side code and instead recommend a server-side/proxy flow (or short-lived
per-user tokens) that injects the Bearer token on behalf of clients; keep the
curl example as a server-side usage example and add a short note: "Do not expose
this key in browser code — use a trusted backend or proxy to attach
Authorization headers."
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 69771268-c670-41a7-b542-529f164def3b
📒 Files selected for processing (2)
docs/HyperIndex/Hosted_Service/hosted-service-features.mddocs/HyperIndexV2/Hosted_Service/hosted-service-features.md
Comment on lines
+63
to
+80
| Protect your endpoint with an API key—a secret token that clients include with each request to prove they're authorized. This is the recommended option for browser-based dApps and frontends, where users connect from unpredictable IP addresses that can't be allow-listed. | ||
|
|
||
| **How it works:** | ||
| - Each indexer (project) gets a **unique API key**, automatically generated and securely stored | ||
| - Retrieve your API key from the deployment dashboard | ||
| - Include it with every request using the `Authorization` header as a Bearer token: | ||
|
|
||
| ```bash | ||
| curl https://<your-endpoint>/v1/graphql \ | ||
| -H "Authorization: Bearer <your-api-key>" | ||
| ``` | ||
|
|
||
| Requests without a valid key are rejected with a `401 Unauthorized` response. | ||
|
|
||
| **Benefits:** | ||
| - Works for browser-based apps and frontends with no fixed IP address | ||
| - The same key persists across deployment promotions | ||
| - Both your production endpoint and per-deployment URLs are gated by the same policy—no way to bypass authentication |
Contributor
There was a problem hiding this comment.
Don’t recommend a shared API key for browser clients.
The “recommended option for browser-based dApps and frontends” wording is unsafe: if this bearer token is embedded client-side, any user can extract and reuse it. Please reframe this as a server-side/proxy flow or explicitly state that the key must never be exposed in the browser.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/HyperIndex/Hosted_Service/hosted-service-features.md` around lines 63 -
80, The doc currently recommends using a shared API key for "browser-based dApps
and frontends" which is unsafe; update the text around the "recommended option
for browser-based dApps and frontends" and the Authorization/Bearer example to
explicitly prohibit embedding the API key in client-side code and instead
recommend a server-side/proxy flow (or short-lived per-user tokens) that injects
the Bearer token on behalf of clients; keep the curl example as a server-side
usage example and add a short note: "Do not expose this key in browser code —
use a trusted backend or proxy to attach Authorization headers."
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
Documentation