Settings & Secrets

Configure your API with settings for public configuration and secrets for sensitive credentials.

Custom Settings

Settings are simple key-value pairs accessible via the API. Use them for application configuration that doesn't need to be secret.

Creating Settings

1. Go to Settings → Custom Settings
2. Click Add Setting
3. Enter a key and value
4. Save

Accessing Settings

Retrieve settings via the _settings endpoint:

GET https://eu.restapi.com/my-api/_settings

Response:

{
  "featureFlags": "dark-mode,beta-features",
  "maxUploadSize": "10485760",
  "supportEmail": "support@example.com"
}

Use Cases

Use Case	Example
Feature flags	enableNewUI: true
Configuration	maxItemsPerPage: 50
Public values	companyName: Acme Corp
Environment settings	environment: production

note

Settings are not encrypted. Don't store sensitive data like passwords or API keys here. Use Secrets instead.

Secrets

Secrets are encrypted credentials that can only be accessed by functions. They're never exposed via the API.

Creating Secrets

1. Go to Settings → Secrets
2. Click Add Secret
3. Enter a key and value
4. Save

Security Features

• Encrypted at rest — Values stored securely
• Hidden by default — Values shown as asterisks
• Function-only access — Cannot be retrieved via API
• One-way storage — You cannot retrieve the original value

Using Secrets in Functions

1. When editing a function, select which secrets to inject
2. Access them via the secrets object:

const apiKey = secrets.STRIPE_API_KEY;
const webhookSecret = secrets.WEBHOOK_SECRET;

await fetch('https://api.stripe.com/v1/charges', {
  headers: {
    'Authorization': `Bearer ${secrets.STRIPE_SECRET_KEY}`
  }
});

Use Cases

Use Case	Example Key
API keys	STRIPE_API_KEY
Database credentials	DB_PASSWORD
OAuth secrets	GOOGLE_CLIENT_SECRET
Webhook secrets	WEBHOOK_SIGNING_SECRET
Encryption keys	ENCRYPTION_KEY

warning

Never log secrets or include them in error messages. They should remain hidden.

Service Connections

Service connections define how to authenticate with external services.

Creating a Connection

1. Go to Settings → Service Connections
2. Click Add Connection
3. Configure:
   • Name — Identifier for the connection
   • Auth Method — OAuth2Token, APIKey, or custom
   • Auth URL — Authentication endpoint
   • Request Fields — Parameters like client_id, client_secret

Use Cases

• Standardize how functions connect to external APIs
• Centralize authentication configuration
• Simplify function code

Web App Settings

Configure your hosted web application.

General Settings

Setting	Description
Web App URL	Your application hostname (.restapi.cloud or custom domain)
Login URL	Direct link to hosted login page

Login Customization

Brand the login experience:

Setting	Description
Logo URL	URL to your logo image
Background Color	Hex color code for background
Login Header	Custom text above login buttons
Redirect URIs	Allowed redirect URLs after login

Security Headers

Configure HTTP security headers:

Header	Purpose
CSP	Content Security Policy — controls resource loading
HSTS	HTTP Strict Transport Security — forces HTTPS
X-Frame-Options	Prevents clickjacking
X-Content-Type-Options	Prevents MIME sniffing
Referrer-Policy	Controls referrer information
Permissions-Policy	Controls browser features

Click Set to Default to apply recommended security values.

File Explorer

Upload static files for your web app:

1. Go to App Settings → Files
2. Drag and drop files or click to select
3. Files are immediately available at your web app URL

Supported files: HTML, CSS, JavaScript, images, PDFs, audio, video, and more.

Security Settings

Authentication Providers

Configure identity providers for user authentication:

1. Go to Security → Auth Providers
2. Click + New authentication provider
3. Select a provider and configure credentials

Provider	Configuration
Microsoft	Client ID, optional single-tenant with Organization
Google	Client ID
Apple	Client ID
Facebook	App ID, Secret
OpenID Connect	Client ID, Secret, Issuer URL
Passkey	No credentials required (WebAuthn)
Vipps	Client ID, Secret, Subscription Key, MSN
Vipps MT (Test)	Test environment for Vipps

Options:

• Single tenant (Microsoft only) — Restrict to a specific Azure AD organization
• Login with popup — Use popup window instead of redirect

CORS

Control which domains can access your API:

1. Go to Security → CORS
2. Add allowed origins
3. Configure allowed methods and headers

IP Whitelist

Restrict API access to specific IP addresses:

1. Go to Security → IP Whitelist
2. Add trusted IP addresses or ranges

reCAPTCHA

Protect against bots:

1. Go to Security → reCAPTCHA
2. Enable and configure your site key
3. Choose v2 or v3
4. Set score threshold (v3)

Cookie Authentication

Enable cookie-based authentication:

1. Go to Security → Cookies
2. Enable cookie authentication
3. Configure CSRF protection

Best Practices

• Use Secrets for credentials — Never store sensitive data in Settings
• Descriptive key names — Use clear names like STRIPE_API_KEY
• Document settings — Keep track of what each setting does
• Rotate secrets regularly — Update credentials periodically
• Limit secret access — Only inject secrets into functions that need them
• Test security headers — Verify headers don't break your application