Secret Keys & API Authentication

Secret Keys provide secure, database-scoped authentication for making direct REST API calls to your NoCodeBackend databases.

Every database in your workspace can have one or more Secret Keys generated for it. These keys act as Bearer tokens in the HTTP Authorization header when querying your auto-generated CRUD endpoints.

1. How Secret Keys Work

When you provision a database, NoCodeBackend instantly generates a complete set of RESTful API endpoints for every table you create. To ensure your data remains secure from unauthorized access, all REST API endpoints require a valid Secret Key.

Key Characteristics:

• Database Scoped: A Secret Key belongs strictly to a single database instance. A key created for Database A cannot query Database B.
• Header Authorization: Secret Keys are sent as a Bearer token in your HTTP request headers: Authorization: Bearer ncb_sec_...
• Instant Revocation: If a key is compromised, you can delete or regenerate it instantly from the Secret Keys modal in your database view.

2. Generating a Secret Key

1. Navigate to the Databases dashboard.
2. Locate the database you wish to connect to.
3. Click the three dots menu (...) on the database card and select Secret keys.
4. Click Create New Key, enter a descriptive name (e.g., Backend Integration), configure scopes or allowed domains, and submit.
5. Copy the generated key. Store it safely, as raw key secrets are hashed for security once created.

3. Making Authenticated API Requests

Include your secret key in the Authorization header of your HTTP requests using standard Bearer authentication. Specify your database instance via the Instance query parameter:

curl -X GET "https://api.nocodebackend.com/read/your_table?Instance=your_database" \
  -H "Authorization: Bearer ncb_sec_your_secret_key_here" \
  -H "Content-Type: application/json"

Example: JavaScript / Fetch

const response = await fetch("https://api.nocodebackend.com/read/your_table?Instance=your_database", {
  method: "GET",
  headers: {
    "Authorization": "Bearer ncb_sec_your_secret_key_here",
    "Content-Type": "application/json"
  }
});
const data = await response.json();

4. Secret Keys vs. MCP Tokens

• Secret Keys are designed for application code (backend services, scripts, and server actions) making direct REST API calls to specific database tables.
• MCP Tokens (Model Context Protocol) are designed for AI coding assistants (like Cursor, Windsurf, Claude, or Antigravity) to inspect your workspace schema and assist you while coding. MCP tokens are managed under Developer > Tokens.