Skip to content
Accquix Register
Esc
↑↓navigate↵open⌘Jpreview
On this page

Authentication

How to call the API: API keys stored only as hashes, the explicit anonymous mode and its limits, and the endpoints that need no key.

Every data endpoint needs an API key, sent as a Bearer token:

curl -H "Authorization: Bearer $KEY" "http://localhost:8080/v1/search?q=zlata"

Keys

The instance stores only the SHA-256 hashes of its keys, in REGISTER_API_KEYS, as name:hash pairs:

KEY=$(head -c 24 /dev/urandom | od -An -tx1 | tr -d ' \n')
printf %s "$KEY" | sha256sum      # put "pro:<hash>" into REGISTER_API_KEYS

The key name appears in the access log and is the unit of rate limiting. Give each consumer its own key. A wrong key is always rejected with 401, even when anonymous access is on.

Anonymous mode

Without keys, serve refuses to start. To serve without keys, set REGISTER_ALLOW_ANONYMOUS=true explicitly. Then:

  • requests without an Authorization header are allowed and rate-limited per client IP;
  • the lookup of natural persons without an IČO by DIČ is unavailable (403), to protect their data;
  • /v1/capabilities reports anonymous: true.

Public endpoints

These answer without a key: /livez, /readyz, /openapi.json and /openapi.yaml.

What is logged

The access log records the route, the status, the duration and the key name. It never records the search query, the identifier in the path or any data.