#community-help

Limiting API Key Access by Domain

TLDR Loic wanted to limit API key access to a specific domain. Jason clarified this limitation, discussing how Google achieves it via their VPN-like service.

10mo

Join the chat

Jan 28, 2023 (10 months ago)

Photo of md5-3a88a602e4aba6a18b4a6c6985fcf08c

Loic

05:25 PM

Hey Jason , how are you ?
It would be nice to be able to limit the API key from a specific web domain only

Photo of md5-8813087cccc512313602b6d9f9ece19f

Jason

05:27 PM

This would be impossible to do since, the only mechanism available to do this is via HTTP headers set by the browser, but that can be trivially changed by users if they use curl or some browser extensions

Loic

05:29 PM

In Google Cloud Patform you have this domain selection option for the APIs. I don’t know how they do it :thinking_face:

Jason

05:34 PM

Could you link me to the docs for it?

Loic

05:57 PM

https://cloud.google.com/iap/docs/allowed-domains

Jason

06:02 PM

This seems to talk about Google’s VPN-like service and restricting access to only certain domains via that service…

Typesense

Lightning-fast, open source search engine for everyone | Knowledge Base powered by Struct.AI

Indexed 3011 threads (79% resolved)

Join Our Community

Similar Threads

Validating Client Side Search Adapter Effectiveness and Tips

Keith asked Jason about enumeration attacks and IP blocking. Jason suggested using Cloudflare for IP-blocking, using limited API keys, and shared a method to proxy through Cloudflare to Typesense. Keith also shared a resource about Cloudflare workers.

23mo

Protecting Typesense Queries from DOS Attacks

Juri sought advice on securing typesense queries. Jason suggested use of Cloudflare for DOS attack protection and explained how to create user-specific API keys for data authorization. Ricardo endorsed Cloudflare for protection.

33mo

Querying Limit to API Keys in a Cluster

Iulian asked about the limit of API keys in a cluster. Kishore Nallan clarified there is no limit but the key listing end point lacks pagination for easy browsing.

4mo