Bando
GitHubCommunity

Bando Documentation

REST authentication

Authenticate clients and use Bearer tokens to access protected resources.

Why does authentication exist?

The Bando API may contain private content and operations that modify data. For this reason, certain endpoints require a valid API key to authorize access.

How it works

1. API KeyThe client obtains an API key from the Bando project.
2. RequestThe client sends the API key in the request header.
3. APIBando validates the provided API key.
4. ResponseThe API processes the request if authentication is valid.

Using an API key

Requests to the Document API must include the API key through the X-Bando-API-Key header.

GET/api/:collection

Send the API key in the request header.

BASH
curl http://localhost:3333/api/posts \
-H "X-Bando-API-Key: YOUR_API_KEY"

In JavaScript, the API key can be sent as follows:

JAVASCRIPT
const response = await fetch(
"http://localhost:3333/api/posts",
{
headers: {
"X-Bando-API-Key": "YOUR_API_KEY",
},
}
);
​
const { data } = await response.json();

API key header

The X-Bando-API-Key header identifies and authenticates the project making the request.

HTTP
X - Bando - API - Key: YOUR_API_KEY

Authenticated requests

Authentication is required for protected Document API endpoints. The API key must be included with every request that requires authentication.

BASH
curl http://localhost:3333/api/posts \
-H "X-Bando-API-Key: $BANDO_API_KEY"

Authentication errors

Requests without a valid API key are not authorized by the API. Make sure the header is present and that the API key belongs to the correct project.

  • X-Bando-API-Key missing — the request is not authenticated.
  • Invalid API key — authentication fails.
  • Valid API key — the request can be processed according to the available permissions.
REST authentication | Bando