🔐 How to make the Xano db/APIs private with a static bearer token

Leonor Torres

👋 community!

I'm looking for a solution to make all APIs/dbs private in Xano with one single bearer.

Has anyone found a way to create a static bearer token so it can be authenticated in the front-end request headers?

Thank you!

Michael Udinski

You could create a solution similar to this - but you wouldn't be using the endpoints in a user authentication manner because the Xano authentication token is tied to a unique user.

But you could create some key - probably not a JWE token since these have an expiration, by definition - potentially a UUID or something else. Store this in an environment variable and have your API endpoint start with a precondition to make sure the key passed in the headers equals what's stored in the environment variable.
This is similar-ish question from office hours, although it's a per user API key, but along the same idea - https://youtu.be/9KvsWOhpX6g