API keys in Wappi provide a secure way to authenticate and authorize access to your API endpoints. They serve as a unique identifier for your application and help protect against unauthorized access.
API keys are configured in your wappi.json file and environment variables:
1{
2 "apiKey": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4687121gj2hg3hj12g",
3 "private": false,
4 "domains": "yourdomain.com, api.yourdomain.com"
5}1# Current and previous API keys for rotation
2AUTH_KEY_CURRENT=your-current-api-key
3AUTH_KEY_PREVIOUS=your-previous-api-key
4
5# Environment setting
6ENVIRONMENT=prodWappi uses API keys to:
API keys are included in request headers:
1// Frontend request with API key
2fetch('https://api.yourdomain.com/users', {
3 method: 'GET',
4 headers: {
5 'Authorization': 'Bearer your-api-key',
6 'Content-Type': 'application/json'
7 }
8})When you initialize a new Wappi project, an API key is automatically generated:
1npx wappi init
2
3# During initialization, Wappi generates:
4# - A unique API key for your project
5# - Configuration files with security settings
6# - Environment variable templatesYou can generate new API keys manually for key rotation:
1// Generate a secure API key
2const crypto = require('crypto')
3const apiKey = crypto.randomBytes(32).toString('hex')
4console.log('New API Key:', apiKey)Wappi supports automatic API key rotation for enhanced security:
1{
2 "authRotation": "0 0 * * 0", // Weekly rotation (every Sunday at midnight)
3 "apiKey": "current-key",
4 "domains": "yourdomain.com"
5}Configure API keys in your frontend application:
1// wappiConfig.ts
2import { WappiConfig } from 'wappi-fe/types'
3
4export const WAPPI_CONFIG: WappiConfig = {
5 apiUrl: 'https://api.yourdomain.com',
6 apiKey: process.env.NEXT_PUBLIC_WAPPI_API_KEY,
7 authRedirectPath: '/login'
8}1import { request } from 'wappi-fe'
2import { WAPPI_CONFIG } from './wappiConfig'
3
4const response = await request(WAPPI_CONFIG, {
5 name: 'Get User Data',
6 query: 'User_GetUserData_1_0_0',
7 data: { userId: '123' },
8 authRequired: true // Uses API key authentication
9})Protect specific endpoints with API key requirements:
1// API/User/GetUserData/1.0.0/index.ts
2export default async function GetUserData(body: User_GetUserData_1_0_0__Body) {
3 // API key validation is handled automatically by Wappi
4 // This endpoint is only accessible with valid API key
5
6 try {
7 const userData = await getUserById(body.userId)
8 return {
9 success: true,
10 data: userData
11 }
12 } catch (error) {
13 throw new Error('Failed to retrieve user data')
14 }
15}Invalid API Key Error:
1{
2 "success": false,
3 "message": "Invalid API key",
4 "statusCode": 401
5}Solutions:
1// Test API key validation
2curl -X GET https://api.yourdomain.com/health \
3 -H "Authorization: Bearer your-api-key" \
4 -H "Content-Type: application/json"For production environments, integrate with AWS Secrets Manager for secure key storage:
1// Store API keys in AWS Secrets Manager
2aws secretsmanager create-secret \
3 --name "wappi/api-keys" \
4 --description "Wappi API Keys" \
5 --secret-string '{
6 "current": "your-current-api-key",
7 "previous": "your-previous-api-key"
8 }'1// Retrieve keys in your application
2const AWS = require('aws-sdk')
3const secretsManager = new AWS.SecretsManager()
4
5async function getApiKeys() {
6 const secret = await secretsManager.getSecretValue({
7 SecretId: 'wappi/api-keys'
8 }).promise()
9
10 return JSON.parse(secret.SecretString)
11}