Documentation/Developers
Back
  • Getting started
    • Frontends and app types
    • Environments and endpoints
  • OAuth clients
    • Client ID and secret
    • Redirect URIs and start URL
    • Secret rotation
  • Login with appsolut
    • Authorization code flow
    • Tokens and claims
    • Frontend role
    • Sign-out
    • Revocation and issued tokens
    • Token endpoint errors
  • Frontend keys
    • Issue and store a key
    • Send a key
    • Rotate and revoke
  • Members API
    • Eligibility from a backend
    • The signed-in member
    • Results, rate limits and errors
    • Is an applicant an eligible member?
    • The signed-in frontend user's membership
  • appsolut register API
    • Implement the API
    • Connect and test
    • Verify a member with their challenge code
    • List every member
    • The status of several members
    • The status of one member
    • The person data of several members
    • The person data of one member
    • The claims of several members
    • The claims of one member
    • Health check

Frontend keys

The secret a frontend's backend uses to call the Studio without a signed-in user.

A frontend key is a secret an organisation issues to one frontend, so the frontend's own backend can call the Studio's Members API. It authenticates the backend, not a person: a call with it needs no signed-in user, such as asking whether an applicant is an eligible member.

The key decides everything about the caller: the organisation, the frontend and with it the frontend's community. Nothing in a request can name another organisation or frontend.

Why a key, and not OAuth

OAuth's way to authenticate a server is the client_credentials grant, which the Studio's OAuth server does not offer. So each frontend gets its own frontend key instead:

  • issued in the Studio and shown once;
  • stored by the Studio only as a hash, with its first characters to recognise it;
  • up to two active at a time, so you can switch to a new key without downtime;
  • revoked immediately when you no longer need it.

This is the lasting mechanism, not a stopgap. The client secret and the frontend key are different secrets: the client secret is only for the token endpoint of Login with appsolut, the frontend key only for the Members API.

What it looks like

ofk_3f9a1c2b7d4e_<64 hexadecimal characters>

ofk_, then a 12-character prefix the Studio shows on the frontend's "Keys" card, then the secret.

In this section

  • Issue and store a key: issuing a key in the Studio and keeping it on your server.
  • Send a key: the header, and the answers to a refused key.
  • Rotate and revoke: switching keys without downtime, and revoking one.