Hi guys, quick question - can the web portal which...
# community-helps
Shaun Byrnes
03/13/2023, 10:31 AMHi guys, quick question - can the web portal which creates API keys, also create scoped API keys, or only top level ones at this time and scoped must be done privileged environment from code?
👍 1
k
Kishore Nallan
03/13/2023, 10:40 AMWe don't yet have a way to generate scoped API key from the UI. That's because it is a client side operation as all it does is take a parent search-only API key and then encodes it along with a filter clause and also adds a hmac signature of the filter clause so that it cannot be tampered.
But I think it will be useful to have a UI for it as well.
👍 1
Kishore Nallan
03/13/2023, 10:40 AMThe scoped API keys are not stored on the server since they are generated by encoding the filter into the key, which is then extracted during the search request cycle.
s
Shaun Byrnes
03/13/2023, 12:00 PMGotcha. But even tho its made from a search only API key, we should do this server side in trusted environment correct ?
Shaun Byrnes
03/13/2023, 12:01 PMAs if we use TS SDK on actual client end (Java/Swift) to make the scoped key from Search only key, it defeats the purpose as far as I can see
k
Kishore Nallan
03/13/2023, 12:15 PMNo the search only key contains a hmac signature for confirming the filter by string is not tampered -- it's revalidated on the server side.
j
Jason Bosco
03/13/2023, 7:07 PMBut even tho its made from a search only API key, we should do this server side in trusted environment correct ?That’s correct. You want to use the parent search api key and generate a scoped API key on the server-side, send that scoped API key to the client-side and then have the client-side make calls to Typesense directly
✔️ 1
Jason Bosco
03/13/2023, 7:07 PMYou do not want to expose your parent (unscoped) API key to the client-side, because that will then allow access to all data in the collection
s
Shaun Byrnes
03/13/2023, 10:11 PMyes exactly my thoughts
Shaun Byrnes
03/13/2023, 10:12 PMAs I suspected this, thats why I was checking ifwe could create from the cloud web GUI - to save some time for testing purposes, before spinning up for Firebase cloud servers, loading the typesense SDK and generating keys etc. BUt now I know thats the only way currently - all good!
Shaun Byrnes
03/13/2023, 10:12 PMWould be good to be able create from the web GUI in future tho - small quality of life feature
👍 1