Auth, tokens, and API secrets

Editions: Open Source · Free Cloud · Pro · Workers

Apito separates platform credentials (Console / CLI / MCP) from project credentials (app data).

Credential types

Credential	Use
Console session / sync key	System GraphQL — projects, drafts, platform ops
Role API key (`ak_…`)	Secured project GraphQL / REST, limited to that role
Login API key (`ak_…`, role `login`)	`registerUser` and `loginUser` only. `/secured/graphql` returns `BOOTSTRAP_KEY_ON_SECURED`
App-user JWT	Secured GraphQL as that user (RBAC applies)

A role key calls the content API. A login key does not. Never send either key to /system/graphql for model data, and never use a Console-only token as your app’s public API auth.

App users

Enable auth for the project, then register/login via Engine-supported mutations or Admin SDK auth helpers. Store tokens server-side when possible (BFF). Client apps should refresh according to your token TTL.

Tenant SaaS

Pass tenant id on list/mutate calls (tenant_id filter and/or X-Apito-Tenant-ID). See Filters & relations and RBAC.

Secrets hygiene

Rotate compromised ak_ keys in Console.
Keep .env out of Blueprints (repo ships .env.example only).
Prefer short-lived user tokens for browsers.