Authentication
BaxCloud uses Stripe-style keys: a publishable client key for apps and a secret server key for your backend.
Key types
bax_pk_…Publishable. Safe to embed in React, React Native, Flutter, Swift, or Kotlin apps. Enable scopes for Realtime, BaxLinks, and/or BaxVerify when you create the key.
bax_sk_…Secret. Use only on your backend with @baxcloud/baxcloud-server-sdk. Full API access for enabled product scopes (including Mail and Stream).
Legacy keys
bax_… keys (without pk or sk) are treated as server keys. Create new keys from the dashboard when you rotate credentials.Headers
Authorization: Bearer YOUR_API_KEY
X-Project-Id: YOUR_PROJECT_ID
Content-Type: application/jsonLinks SDKs also accept X-Api-Key. Public REST base URL: https://api.baxcloud.tech
What each key can do
| Operation | Client bax_pk_ | Server bax_sk_ |
|---|---|---|
| Realtime: token, single room, participants | Yes (Realtime scope) | Yes |
| List all rooms / egress / ingress admin | No | Yes |
BaxLinks SDK (/sdk/links: resolve, deferred, events, create, CRUD) | Yes (Links scope) | Yes |
BaxVerify: POST /auth/sms/send & /verify | Yes (Verify scope) | Yes |
BaxVerify: validate-token, logs, stats | No — call from backend | Yes |
| BaxMail / BaxStream / Video Editor | No | Yes (if scope enabled) |
Usage examples
Realtime app (client key)
1import { BaxCloudProvider } from '@baxcloud/react-sdk';
2
3<BaxCloudProvider
4 projectId={process.env.NEXT_PUBLIC_BAXCLOUD_PROJECT_ID!}
5 apiKey={process.env.NEXT_PUBLIC_BAXCLOUD_CLIENT_KEY!} // bax_pk_… + Realtime scope
6>
7 <App />
8</BaxCloudProvider>Flutter Links / Verify (client key)
1// BaxLinks — enable Links scope on the client key
2final links = BaxCloudLinksClient(
3 config: BaxCloudLinksConfig(
4 projectId: 'YOUR_PROJECT_ID',
5 apiKey: 'bax_pk_…',
6 ),
7);
8
9// BaxVerify — enable Verify scope; validate-token stays on your backend with bax_sk_
10final verify = BaxCloudVerifyClient(
11 config: BaxCloudVerifyConfig(
12 projectId: 'YOUR_PROJECT_ID',
13 apiKey: 'bax_pk_…',
14 ),
15);
16await verify.sendOtp(SendOtpOptions(phone: '+14155552671'));Backend (server key)
1import { BaxCloudServerClient } from '@baxcloud/baxcloud-server-sdk';
2
3const client = new BaxCloudServerClient({
4 apiKey: process.env.BAXCLOUD_SERVER_KEY!, // bax_sk_…
5 projectId: process.env.BAXCLOUD_PROJECT_ID!,
6});
7
8const { items } = await client.listRooms({ status: 'ACTIVE' });Phase 3 — Hardening
Rate limits
Client keys default to 120 requests/minute (Redis-backed). Override per key in the dashboard. Server keys use the global API throttle unless you set a custom limit.
Client: origins & bundle IDs
Optionally lock a bax_pk_ key to web origins (Origin / Referer) and mobile package names via X-Bundle-Id. Client SDKs send this automatically (Flutter / Kotlin / Swift / React Native) or accept an optional bundleId override. Empty lists = unrestricted. Wildcard origins like https://*.example.com are supported.
Server: IP allowlist
Optionally restrict a bax_sk_ key to specific IPs or CIDRs (e.g. 10.0.0.0/8). Empty = unrestricted.