Requests to Infino Cloud are authenticated with an API key. This
page covers where the key comes from, how to supply it, how it travels on the wire, and
how to rotate it.
API keys
An API key is a string beginning inf_…, created in the Infino Cloud console at
platform.infino.ws — the only place keys are minted (there
is no SDK or API call to create one). Treat it like a password: it grants full access to
the databases it’s scoped to.
You give the key to connect in one of two ways.
Pass it explicitly:
Or read it from the environment. Set INFINO_API_KEY and the key argument becomes
optional. This keeps the secret out of your source:
Prefer INFINO_API_KEY over hard-coding the key. It keeps the secret out of your code
and version control, and lets deployment tooling inject it at runtime.
How the key is sent
The API key is sent as an HTTP Authorization: Bearer <key> header on every request:
https:// is required for any remote host so the key is never sent in the clear.
Plain http:// is accepted only for localhost / 127.0.0.1 (loopback), for local
development against a service you run yourself. A remote http:// URL is rejected at
connect, so a bearer token never travels over an unencrypted connection.
Rotating a key
Rotate a leaked or expiring key in the console. Create a new key, roll it out to
your deployments (update INFINO_API_KEY or the value you pass to connect), then
revoke the old one. A revoked key stops working immediately, so revoke only after the
new key is in place.
See also
