Secret Keys & API Authentication

Secret Keys provide secure, database-scoped authentication for making direct REST API calls to your NoCodeBackend databases.

Every database in your workspace can have one or more Secret Keys generated for it. These keys act as Bearer tokens in the HTTP Authorization header when querying your auto-generated CRUD endpoints.

1. How Secret Keys Work

When you provision a database, NoCodeBackend instantly generates a complete set of RESTful API endpoints for every table you create. To ensure your data remains secure from unauthorized access, all REST API endpoints require a valid Secret Key.

Key Characteristics:

• Database Scoped: A Secret Key belongs strictly to a single database instance. A key created for Database A cannot query Database B.
• Header Authorization: Secret Keys are sent as a Bearer token in your HTTP request headers: Authorization: Bearer ncb_sec_...
• Instant Revocation: If a key is compromised, you can delete or regenerate it instantly from the Secret Keys modal in your database view.

2. Generating a Secret Key

1. Navigate to the Databases dashboard.
2. Locate the database you wish to connect to.
3. Click Secret Keys on the database card.
4. Click Create New Key and enter a descriptive name (e.g., Production Mobile App).
5. Copy the generated key. Store it safely, as raw key secrets are hashed for security once created.

3. Making Authenticated API Requests

Include your secret key in the Authorization header of your HTTP requests:

curl -X GET "https://api.nocodebackend.com/v1/your_database/your_table" \
  -H "Authorization: Bearer ncb_sec_your_secret_key_here" \
  -H "Content-Type: application/json"

Example: JavaScript / Fetch

const response = await fetch("https://api.nocodebackend.com/v1/your_database/your_table", {
  method: "GET",
  headers: {
    "Authorization": "Bearer ncb_sec_your_secret_key_here",
    "Content-Type": "application/json"
  }
});
const data = await response.json();

4. Secret Keys vs. MCP Tokens

• Secret Keys are designed for application code (frontend or backend apps) making direct REST API calls to specific database tables.
• MCP Tokens (Model Context Protocol) are designed for AI coding assistants (like Cursor, Windsurf, or Claude) to inspect your workspace schema and assist you while coding.