Authentication & API Tokens

All external (public) API endpoints require authentication via API tokens. This page covers how to create, configure, and use API tokens.

Creating an API Token

1. Navigate to API Tokens in your dashboard sidebar
2. Click Create Token
3. Configure:
   • Name: A descriptive name (e.g., "Portfolio Site", "Docs Portal")
   • Allowed Origins: Comma-separated list of domains that can use this token (for CORS)
   • Expires At: Optional expiration date

The token is displayed once after creation. Store it securely.

Using the Token

Headers & Contexte projet

La plupart des tokens API sont liés à un projet. Dans ce cas, le backend déduit automatiquement le projet depuis le token et X-Project-Id n’est pas requis pour les endpoints publics.

Tu peux envoyer le token de 2 façons:

Authorization: Bearer YOUR_API_TOKEN

ou

x-api-key: YOUR_API_TOKEN

Cas particuliers:

• Certains endpoints “publics” acceptent un projectId en query (ex: docs public anonyme).
• Les appels internes du dashboard utilisent un contexte projet géré par l’app web.

Example: Fetch with JavaScript

const response = await fetch('https://api.example.com/api/portfolio/v1/public/all', {
  headers: {
    'Authorization': 'Bearer your-token-here',
  },
});
const data = await response.json();
console.log(data);

Example: cURL

curl -H "Authorization: Bearer your-token-here" \
     https://api.example.com/api/portfolio/v1/public/all

Example: Python

import requests

headers = {
    'Authorization': 'Bearer your-token-here',
}

response = requests.get(
    'https://api.example.com/api/portfolio/v1/public/all',
    headers=headers,
)
data = response.json()
print(data)

Token Security

• Tokens are stored as bcrypt hashes in the database
• The raw token is only shown at creation time
• Revoke tokens immediately if compromised
• Use allowed origins to restrict which domains can use the token
• Set expiration dates for time-limited access

Allowed Origins

When creating a token, you can specify allowed origins. The CORS middleware validates the Origin header against this list:

• https://mysite.com — exact match
• http://localhost:3000 — local development
• Leave empty to allow all origins (not recommended for production)