is it really required to provide the apikey on bot...
# support-questions-legacyk
kelchy2714
09/08/2022, 3:37 AMis it really required to provide the apikey on both frontend and backend?
r
rp_st
09/08/2022, 3:39 AMHey
rp_st
09/08/2022, 3:39 AMThe api key is only to be provided on the backend. Not the frontend
rp_st
09/08/2022, 3:40 AMIs there anything in the docs that made you think it’s frontend as well?
k
kelchy2714
09/08/2022, 3:45 AMthanks for verifying @rp_st
kelchy2714
09/08/2022, 3:47 AMapikey was not on docs. i only saw it on the example apps
kelchy2714
09/08/2022, 3:47 AMsearch "apikey" on docs sent me to sms api key
r
rp_st
09/08/2022, 3:48 AMHmmmthe quick setup > backend section mentions the api key.
k
kelchy2714
09/08/2022, 3:48 AMchecked, it's there
kelchy2714
09/08/2022, 3:48 AMsearch is not too helpful, i figured have to keep on searching
kelchy2714
09/08/2022, 3:48 AMit does not list occurences
r
rp_st
09/08/2022, 3:49 AMHmm noted. We will see what we can do
k
kelchy2714
09/08/2022, 3:49 AMcool thanks
kelchy2714
09/08/2022, 3:50 AMon the same topic, if the react app sends apis to different microservices
kelchy2714
09/08/2022, 3:50 AMand each microservice validates the session with a managed ST
kelchy2714
09/08/2022, 3:50 AMdo i need the apikey everywhere?
r
rp_st
09/08/2022, 3:52 AMYes. All of those backends
k
kelchy2714
09/08/2022, 3:59 AMis there a way to configure an apikey just for validating sessions? my concern is that i dont control some of these microservices. and they can go in and mess with the metadatas
r
rp_st
09/08/2022, 4:00 AMNot at the moment. What you can do is to issue JWT along with a session and instead of sending the session access token, you send the JWT to the microservices which can then verify it without needing to ever query the core
k
kelchy2714
09/08/2022, 4:04 AMalrighty, let me check this out. good idea
kelchy2714
09/08/2022, 7:03 AMhi rishabh, looks promising although i feel the jwt is too heavy to lug around and i feel iffy using it like a session token
r
rp_st
09/08/2022, 7:04 AMright.. then you will have to provide the core API key to those microservices