Secure API Usage

Follow these best practices to keep your data safe.

Keep API Keys Secret

Store keys in environment variables
Never commit keys to version control
Never include keys in client-side JavaScript

# .env
CUBESTACK_API_KEY=your-api-key

Use Public Access for Frontends

For browser-based applications, enable public access on your cubes and only mark safe columns as public:

// No API key needed — only public columns returned
const response = await fetch('https://api.cubestack.app/api/v1/my-project/products');

Server-Side Only for Write Operations

All write operations (create, update, delete) require an API key. Perform these operations from your server:

// Server-side only
await fetch('https://api.cubestack.app/api/v1/my-project/products', {
  method: 'POST',
  headers: {
    'X-Api-Key': process.env.CUBESTACK_API_KEY,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ title: 'New Product' })
});

Rotate Keys Regularly

If you suspect a key has been compromised, rotate it immediately in the admin panel under Settings > API Keys.

CORS

CubeStack sets appropriate CORS headers for public endpoints. If you need custom CORS configuration, contact support.