API Authentication

> Control who can access your API routes and how often.

Brickr provides several nodes you can add to any route to protect it. Place them at the beginning of your flow, right after the Start Node.

Protecting a route with an API key

The most common way to secure a route is with the Check API Key node:

1. Open your route in the Builder. 2. Add a Check API Key node after the Start Node. 3. Choose where the key should be sent (e.g., header-x-api-key). 4. Connect the valid output to the rest of your flow. 5. Connect the invalid output to a Return JSON node that returns a 401 Unauthorized response.

Callers must include a valid API key in their request. You can create and manage API keys in Settings > API Keys.

curl -H "X-API-Key: your-key-here" https://app.brickr.dev/your-workspace-id/your-api/route

Rate limiting

Add a Rate Limit node to prevent abuse:

1. Add a Rate Limit node after the Start Node (or after Check API Key). 2. Set the limit (e.g., 100 requests per minute). 3. Choose what to rate limit by: ip, user, or api-key. 4. Connect sequence-ok to your flow and sequence-limited to a 429 response.

Restricting origins (CORS)

Use the Check Origin node to allow only specific websites to call your API:

1. Add a Check Origin node. 2. Provide a list of allowed origins (e.g., https://mysite.com). 3. Connect allowed to your flow and blocked to a 403 response.

Combining protections

You can chain these nodes together:

Start Node > Check Origin > Rate Limit > Check API Key > your flow

Each node passes execution forward only if the check passes. If any check fails, the request gets an error response.

You do not need to use all three protections on every route. Choose based on your needs -- a public read-only route might only need rate limiting, while a write endpoint should require an API key.

What's next?

| Topic | Description | |-------|-------------| | Auth Nodes | Detailed reference for all auth nodes | | API Keys | Create and manage API keys | | Creating Routes | Route configuration | | Response Codes | Control HTTP responses |