API Key Management
Learn how to generate, manage, and secure your AuraDash API keys for both production and development environments.
Information & Warnings
Cloudflare Initialization
To connect and authenticate your website, you must add the master secret key to your environment variables on Cloudflare during workspace initialization.
Key Sensitivity
API keys grant access to your website's content and data. Treat them with the same level of security as passwords:
- Copy Immediately: You must copy the generated key immediately. It cannot be viewed again because the database only stores a secure signature rather than the full key.
- Access Control: Do not grant permission to access this settings section to any user or third party unless you are absolutely certain of their trustworthiness.
- Client-Side Exposure: Never expose your keys in client-side code (e.g., raw React or Vue components). Always use server-side proxies or API routes to secure your requests.
- Never commit keys to public GitHub repositories.
- Store keys securely in server-side environment variables.
- Rotate keys immediately if you suspect they have been compromised.
Stateless Keys & Zero-Latency
To guarantee ultra-fast response times (0ms Database Latency) and handle millions of concurrent requests seamlessly, AuraDash employs a stateless decentralized key architecture (Stateless HMAC). The system validates incoming requests mathematically without querying the database for key lookups.
- Individual Key Revocation: Due to this zero-latency design, active keys cannot be individually revoked from the dashboard interface.
- Key Rotation: If a key is compromised, you must rotate the
AURADASH_MASTER_SECRETvariable on your server environment. This updates the signature validation globally, securing all endpoints.
Critical Security Warning:
Do not share either your Public Key or Test Key under any circumstances. These keys are responsible for connecting your landing page to the system and receiving customer bookings. The Test Key is reserved for testing and development environments only, while the Public Key must be deployed once the project is published. AuraDash disclaims all liability for any hacks, compromises, or breaches resulting from user negligence or credential exposure.
Public Key & Production
How to Create a Key
Follow these simple steps in your workspace dashboard to generate a production-ready key:
- From the sidebar navigation menu, open the Settings panel.
- Select the API Key configuration tab.
- Click the Create Key action button in the upper right.
- Configure the key parameters in the popup modal:
- Set Key Type to Production.
- Enter a descriptive Key Name (e.g.,
Main Website). - Specify your live website address in the Allowed Domain field (e.g.,
https://my-website.com).
- Click Generate Key to save and display the credentials.
Production Use Cases
This key acts as the secure bridge between your dashboard content database and your live website:
- Dynamic Landing Page: Instantly fetch and display workspace configurations, including business name, contact links, and opening schedules.
- Content Delivery: Stream services, portfolios, and articles directly onto your public site pages.
- Customer Bookings: Securely capture customer reservations, booking appointments, and contact form submissions, routing them instantly back to your AuraDash database.
Test Key
How to Create a Test Key
Follow these simple steps in your workspace dashboard to generate a test credential:
- From the sidebar navigation menu, open the Settings panel.
- Select the API Key configuration tab.
- Click the Create Key action button in the upper right.
- Configure the key parameters in the popup modal:
- Set Key Type to Test.
- Enter a descriptive Key Name (e.g.,
Local Dev). - Set the key's expiration duration, with a maximum limit of 24 hours.
- Click Generate Key to save and display the credentials.
Test Key Use Cases & Lifespan
Test keys are specifically built for development environments, whether developing locally or via cloud platforms:
- Development Only: Use exclusively for testing your integrations locally on your machine or on cloud AI builders.
- Short Validity: It is highly recommended to set a short expiration lifespan (e.g., a few hours) so that they automatically invalidate quickly, keeping your project secure.
- Expiration: If a test key expires during your development cycle, simply create a new one from the dashboard settings and update your environment configuration.
API Key Errors
Common Warnings & Validation Errors
The API key name field cannot be left blank. Enter a descriptive identifier for your key.
Production keys strictly require an Allowed Domain configuration to prevent cross-origin usage from other websites.
The entered address does not match standard URL/domain formats. Ensure you include standard protocols or subdomains (e.g., https://example.com or localhost).
Test key expiration ranges must be set between a minimum of 1 hour and a maximum limit of 24 hours.
CRITICAL: The backend is missing the AURADASH_MASTER_SECRET environment variable configuration, preventing it from mathematically generating or signing new API keys.