Skip to Content
v2ConceptsAuthentication

Authentication

Authentication is always required. Every request must carry a token, or it is rejected with 401 Unauthorized. There is no anonymous mode.

Token Types

TokenFormScope
db tokendb_name:secret (or db_name:secret:region)All collection / object / search work inside one database
root tokenserver secret (NDD_ROOT_TOKEN)Database and token administration only — cannot run data operations directly

On Endee Serverless, the dashboard issues a db token for your database when you create it. That’s the only token you need for day-to-day work. The root token is managed by the platform.

  • A missing or invalid token → AuthenticationException (401).
  • A read-only (r) token used on a write → ForbiddenException (403).

Endee Serverless

When using Endee Serverless , create a token from the dashboard and pass it when initializing the client. Serverless tokens encode the region (db_name:secret:region), so the client automatically targets https://<region>.endee.io/api/v2. No base URL setup required.

from endee import Endee client = Endee("your-serverless-token")

Keep your token secret and never expose it in client-side code. Load it from an environment variable or secrets manager.

Self-Hosted Server

If you run Endee yourself, point the client at your server’s /api/v2 root with set_base_url, and authenticate with a db token minted by the root token.

from endee import Endee client = Endee("my_db:secret") client.set_base_url("http://localhost:8080/api/v2") # must point at the /api/v2 root

Running Endee yourself? See the Version 1 for Docker setup and the root-token database administration flow.

Managing Tokens

Using a db token, you can manage your own database’s tokens (read-write rw or read-only r) without the root token:

client.create_my_token("reader", token_type="r") # returns a new db token client.list_my_tokens() client.delete_my_token("reader")