Settings & Secrets

Configure your API with secrets for sensitive credentials and connections to external services.

Secrets

Secrets are credentials stored outside your API data, kept out of function code and injected only where you ask for them.

Creating Secrets

1. Go to Settings → Secrets
2. Click Add Secret
3. Enter a key and value
4. Save

Security Features

• Encrypted at rest — Values are stored in a managed key vault, separate from your API data
• Masked by default — Values display as dots until you choose to reveal them
• Not stored with your data — Secrets never appear in your collections, and your API's built-in data endpoints cannot return them
• Injected selectively — A function receives only the keys you explicitly inject, and nothing if you inject none

Your own code can still expose them

Once injected, a secret is an ordinary value inside your function. If your code returns it in a response or passes it to log(), it ends up in the response body or the event log — nothing redacts it on the way out. Keep secrets out of anything you return or log.

Secrets are readable, not write-only

Secret values can be retrieved again after you save them. There are three read paths: the reveal button on each secret in the Portal, the management API (returns stored values in plaintext), and rat api -a <api> secret list.

All three require Contributor access or higher — Read-Only members get a 403. Since reading a secret hands back the credential itself, granting someone write access to an API also grants them every secret it holds. Treat a secret as readable by everyone at Contributor or above.

To retire a credential, rotate it at the source — deleting the secret here does not invalidate it.

Using Secrets in Functions

1. When editing a function, select which secrets to inject
2. Access them via the secrets object:

const apiKey = secrets.STRIPE_API_KEY;
const webhookSecret = secrets.WEBHOOK_SECRET;

await fetch("https://api.stripe.com/v1/charges", {
  headers: {
    Authorization: `Bearer ${secrets.STRIPE_SECRET_KEY}`,
  },
});

Use Cases

Use Case	Example Key
API keys	STRIPE_API_KEY
Database credentials	DB_PASSWORD
OAuth secrets	GOOGLE_CLIENT_SECRET
Webhook secrets	WEBHOOK_SIGNING_SECRET
Encryption keys	ENCRYPTION_KEY

Service Connections

Service connections define how to authenticate with external services.

Creating a Connection

1. Go to Settings → Service Connections
2. Click Add Connection
3. Configure:
   • Name — Identifier for the connection
   • Auth Method — OAuth2Token, APIKey, or custom
   • Auth URL — Authentication endpoint
   • Request Fields — Parameters like client_id, client_secret

Use Cases

• Standardize how functions connect to external APIs
• Centralize authentication configuration
• Simplify function code

Web App Settings

Configure your hosted web application.

General Settings

Setting	Description
Web App URL	Your application hostname (.restapi.cloud or custom domain)
Login URL	Direct link to hosted login page

Login Customization

Brand the login experience:

Setting	Description
Logo URL	URL to your logo image
Background Color	Hex color code for background
Login Header	Custom text above login buttons
Redirect URIs	Allowed redirect URLs after login

Security Headers

Configure HTTP security headers:

Header	Purpose
CSP	Content Security Policy — controls resource loading
HSTS	HTTP Strict Transport Security — forces HTTPS
X-Frame-Options	Prevents clickjacking
X-Content-Type-Options	Prevents MIME sniffing
Referrer-Policy	Controls referrer information
Permissions-Policy	Controls browser features

Click Set to Default to apply recommended security values.

File Explorer

Upload static files for your web app:

1. Go to App Settings → Files
2. Drag and drop files or click to select
3. Files are immediately available at your web app URL

Supported files: HTML, CSS, JavaScript, images, PDFs, audio, video, and more.

Security Settings

Authentication Providers

Configure identity providers for user authentication:

1. Go to Security → Auth Providers
2. Click + New authentication provider
3. Select a provider and configure credentials

Provider	Configuration
Email & Password	No configuration required
Microsoft (shared)	No configuration required (shared Softeria app)
Google (shared)	No configuration required (shared Softeria app)
Microsoft	Client ID, optional single-tenant with Organization
Google	Client ID
Apple	Client ID
Facebook	App ID, Secret
OpenID Connect	Client ID, Secret, Issuer URL
Passkey	No credentials required (WebAuthn)
Vipps	Client ID, Secret, Subscription Key, MSN
Vipps MT (Test)	Test environment for Vipps

Options:

• Single tenant (Microsoft only) — Restrict to a specific Azure AD organization
• Login with popup — Use popup window instead of redirect

CORS

Control which domains can access your API:

1. Go to Security → CORS
2. Add allowed origins
3. Configure allowed methods and headers

IP Whitelist

Restrict API access to specific IP addresses:

1. Go to Security → IP Whitelist
2. Add trusted IP addresses or ranges

reCAPTCHA

Protect against bots:

1. Go to Security → reCAPTCHA
2. Enable and configure your site key
3. Choose v2 or v3
4. Set score threshold (v3)

Cookie Authentication

Enable cookie-based authentication:

1. Go to Security → Cookies
2. Enable cookie authentication
3. Configure CSRF protection

Best Practices

• Use Secrets for credentials — Store sensitive data in Secrets, never in plain configuration
• Descriptive key names — Use clear names like STRIPE_API_KEY
• Rotate secrets regularly — Update credentials periodically
• Limit secret access — Only inject secrets into functions that need them
• Test security headers — Verify headers don't break your application