Authentication & CORS — OQENS Cloud Docs
API Key headers, Bearer tokens, CORS preflight handling, and cross-domain access rules.
All DBaaS v2 endpoints (/api/dbaas/v2/*) are globally accessible from external frontends, mobile applications, edge workers, and backend services.
Authentication Methods
The gateway inspects incoming requests for credentials in the following order:
| Method | Header / Parameter | Example |
|---|---|---|
| Authorization Header (Standard) | Authorization: Bearer <key> |
Authorization: Bearer oq_live_abc123... |
| Custom API Header | X-API-Key: <key> |
X-API-Key: oq_live_abc123... |
| URL Query Parameter | ?apikey=<key> |
https://db.echo.oqens.me/api/dbaas/v2/projects?apikey=oq_live_... |
| Studio Session Cookie | Cookie: oqens_session=... |
Automatic inside *.echo.oqens.me dashboard |
CORS Configuration
The DBaaS gateway returns permissive Cross-Origin Resource Sharing (CORS) headers on all /api/* endpoints to enable seamless client-side fetch() requests:
HTTP Response Headers
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: X-API-Key, X-Access-Code, Content-Type, Authorization
Access-Control-Max-Age: 86400OPTIONS Preflight Handling
The application intercepts all OPTIONS requests at the gateway level before route processing, immediately returning 204 No Content with cached CORS headers.