RealComposer
START FREE
Upstream APIsOfficial Algolia docs

Algolia Safe & Unsafe Practices

Direct Answer

Algolia search-only API keys are safe in clients, and secured API keys add per-user filters on top. The Admin API key and any key with write ACLs must stay on the server, because they can modify or delete indices.

Credentials & Where They Belong

Client safe
Search-only API key

Can only run search queries against allowed indices.

Client safe
Secured API key

Generated server-side with embedded filters and expiry.

Server only
Admin API key

Full control of indices, settings, and keys.

Safe Practices

  • Generate secured keys for user-scoped data

    Embed filters like tenant_id on the server so users cannot search other tenants.

  • Restrict search keys by index and referrer

    Limit each key to specific indices and set rate limits per IP.

Unsafe Practices

  • Shipping the Admin key in a frontend

    Attackers can clear indices or read every record.

  • Filtering private data only on the client

    Client-side filters are easy to remove. Use secured keys or server-side search.

The RealComposer Pattern

Keep ALGOLIA_ADMIN_KEY in the vault for merged search pipelines, and return slim hit objects to clients that only hold a search-only key.

START BUILDING FREE

Frequently Asked Questions

Q:Is the Algolia search-only key safe to expose?

Yes. It only allows search. Make sure indexed records do not contain fields you would not show publicly.

Algolia Recipes

All Algolia recipes (5)
Frontend / WebAlgolia
Security & Secret Vault

Call Algolia Write API from Client without Master Key

To solve call algolia write api from client without master key, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe
Frontend / WebSupabaseAlgolia
Multi-API Aggregation

Combine Algolia Search Results with Supabase User Favorites

To solve combine algolia search results with supabase user favorites, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe

Related Concepts

Principle of Least Privilege

The principle of least privilege states that every user, service, and credential should have only the minimum permissions required to perform its task. For APIs, this means using restricted keys, narrow OAuth scopes, and client tokens limited to specific endpoints.

Multi-Tenant API

A multi-tenant API serves many customers, called tenants, from a shared infrastructure while keeping each tenant data, configuration, and credentials isolated. Requests are identified by tenant using tokens, subdomains, or headers, and policies are applied per tenant.

API Key

An API key is a unique secret string that identifies the application calling an API and authorizes its access. Providers use keys to authenticate requests, enforce quotas, and bill usage. Anyone holding the key can act as your application, so secret keys must stay on trusted servers.