Auth Nodes

> Protect your routes by validating API keys and generating tokens.

Check API Key

The Check API Key node verifies that a valid Brickr API key is included in the request. Place it at the beginning of your flow to protect the route.

| Input | Type | Description | |-------|------|-------------| | keyLocation | Enum | Where to look for the API key (see table below) |

| Output | Type | Description | |--------|------|-------------| | valid | Sequence | Continues here if the key is valid | | invalid | Sequence | Continues here if the key is missing or invalid | | user | Object | The user who owns the API key | | key_info | Object | Information about the API key used |

Key locations

The node can look for the API key in several places:

| Location | Header / Parameter | |----------|-------------------| | Header | Authorization, X-API-Key, API-Key, Auth-Token, Token | | Query parameter | api_key, key, token, access_token | | Request body | api_key, key, token, access_token | | Cookie | api_key, token, auth_token |

Example: Protected route

1. Connect the Start Node to a Check API Key node. 2. Set keyLocation to header-x-api-key. 3. Connect the valid output to the rest of your flow. 4. Connect the invalid output to a Return JSON node that returns a 401 error.

Callers must include a valid API key in the X-API-Key header to access the route.

Generate Code

The Generate Code node creates random codes or JWT tokens.

| Input | Type | Description | |-------|------|-------------| | mode | Enum | random-code or jwt | | length | Number | Length of the random code (for random-code mode) | | charset | Enum | Character set: numeric, alphanumeric, alpha, hex | | jwtSecret | String | Secret key for signing the JWT (for jwt mode) | | jwtPayload | String | JSON payload to include in the JWT | | jwtExpiresIn | Number | Expiration time in seconds |

| Output | Type | Description | |--------|------|-------------| | code | String | The generated code or JWT token |

Random code example

Use random-code mode to generate verification codes, password reset tokens, or one-time passwords.

JWT example

Use jwt mode to create signed tokens for your own authentication system:

1. Set mode to jwt. 2. Provide a jwtSecret (store it in Secrets as {JWT_SECRET}). 3. Set the jwtPayload to a JSON string like {"userId": "123", "role": "admin"}. 4. Set jwtExpiresIn to the desired lifetime in seconds (e.g., 3600 for 1 hour).

Get User ID

The Get User ID node extracts the authenticated user's ID from the request context.

| Input | Type | Description | |-------|------|-------------| | source | String | Where to find the user ID (default: auto) |

| Output | Type | Description | |--------|------|-------------| | userId | String | The user's ID | | isAuthenticated | Boolean | Whether a user was found |

This is useful after a Check API Key node to get the identity of the caller.

Rate Limit

The Rate Limit node limits how many times a route can be called within a time window.

| Input | Type | Description | |-------|------|-------------| | type | Enum | What to rate limit by: ip, user, api-key | | limit | Number | Maximum number of requests allowed | | timeWindow | Number | Length of the time window | | timeUnit | Enum | Unit: seconds, minutes, hours, days |

| Output | Type | Description | |--------|------|-------------| | sequence-ok | Sequence | Continues here if within the limit | | sequence-limited | Sequence | Continues here if the limit is exceeded |

Example: 100 requests per minute

1. Place a Rate Limit node after the Start Node. 2. Set type to ip, limit to 100, timeWindow to 1, timeUnit to minutes. 3. Connect sequence-ok to the rest of your flow. 4. Connect sequence-limited to a Return JSON node with status 429.

Check Origin

The Check Origin node verifies that the request comes from an allowed domain.

| Input | Type | Description | |-------|------|-------------| | allowedOrigins | Array | List of allowed domain origins |

| Output | Type | Description | |--------|------|-------------| | allowed | Sequence | Continues if the origin is allowed | | blocked | Sequence | Continues if the origin is not allowed | | origin | String | The request's origin |

Use this to restrict which websites can call your API routes.

What's next?

| Topic | Description | |-------|-------------| | API Keys | Create and manage API keys | | Secrets | Store JWT secrets and other credentials | | HTTP Nodes | Handle requests and responses |