Auth, tokens, and API secrets

Editions: Open Source · Free Cloud · Pro · Workers

Apito separates platform credentials (Console / CLI / MCP) from project credentials (app data).

Credential types

Credential	Use
Console session / sync key	System GraphQL — projects, drafts, platform ops
Project API key (`ak_…`)	Secured project GraphQL / REST as a service account
App-user JWT	Secured GraphQL as that user (RBAC applies)

Never send an ak_ project key to /system/graphql, and never use a Console-only token as your app’s public API auth.

App users

Enable auth for the project, then register/login via Engine-supported mutations or Admin SDK auth helpers. Store tokens server-side when possible (BFF). Client apps should refresh according to your token TTL.

Tenant SaaS

Pass tenant id on list/mutate calls (tenant_id filter and/or X-Apito-Tenant-ID). See Filters & relations and RBAC.

Secrets hygiene

Rotate compromised ak_ keys in Console.
Keep .env out of Blueprints (repo ships .env.example only).
Prefer short-lived user tokens for browsers.