Authentication
Authentication is always required. Every request must carry a token, or it is rejected with 401 Unauthorized. There is no anonymous mode.
Token Types
| Token | Form | Scope |
|---|---|---|
| db token | db_name:secret (or db_name:secret:region) | All collection / object / search work inside one database |
| root token | server secret (NDD_ROOT_TOKEN) | Database and token administration only — cannot run data operations directly |
On Endee Serverless, the dashboard issues a db token for your database when you create it. That’s the only token you need for day-to-day work. The root token is managed by the platform.
- A missing or invalid token →
AuthenticationException(401). - A read-only (
r) token used on a write →ForbiddenException(403).
Endee Serverless
When using Endee Serverless , create a token from the dashboard and pass it when initializing the client. Serverless tokens encode the region (db_name:secret:region), so the client automatically targets https://<region>.endee.io/api/v2. No base URL setup required.
Python
from endee import Endee
client = Endee("your-serverless-token")Keep your token secret and never expose it in client-side code. Load it from an environment variable or secrets manager.
Self-Hosted Server
If you run Endee yourself, point the client at your server’s /api/v2 root with set_base_url, and authenticate with a db token minted by the root token.
Python
from endee import Endee
client = Endee("my_db:secret")
client.set_base_url("http://localhost:8080/api/v2") # must point at the /api/v2 rootRunning Endee yourself? See the Version 1 for Docker setup and the root-token database administration flow.
Managing Tokens
Using a db token, you can manage your own database’s tokens (read-write rw or read-only r) without the root token:
Python
client.create_my_token("reader", token_type="r") # returns a new db token
client.list_my_tokens()
client.delete_my_token("reader")