algolia-security-basics

# Algolia Security Basics ## Overview Algolia's security model is built around **scoped API keys**. Every Algolia app has three default keys (Admin, Search-Only, Monitoring). For production, create custom keys with minimal permissions and use Secured API Keys for per-user/per-tenant restrictions. ## Key Types and Where to Use Them | Key Type | ACL | Expose to Frontend? | Use Case | |----------|-----|---------------------|----------| | Admin | All operations | **NEVER** | Backend indexing, settings, key management | | Search-Only | `search` only | Yes (safe) | Frontend search widgets | | Monitoring | Read monitoring data | No | Health checks, dashboards | | Custom | You define ACL | Depends on ACL | Scoped backend services | | Secured | Derived from parent key | Yes | Per-user filtered search | ## Instructions ### Step 1: Environment Variable Setup ```bash # .env (NEVER commit — add to .gitignore) ALGOLIA_APP_ID=YourApplicationID ALGOLIA_ADMIN_KEY=admin_api_key_here # Backend only ALGOLIA_SEARCH_KEY=search_only_key_here # OK for frontend # .gitignore — MUST include: .env .env.local .env.*.local ``` ### Step 2: Create Scoped API Keys ```typescript import { algoliasearch } from 'algoliasearch'; const client = algoliasearch(process.env.ALGOLIA_APP_ID!, process.env.ALGOLIA_ADMIN_KEY!); // Create a write-only key for a specific microservice const { key: indexingKey } = await client.addApiKey({ apiKey: { acl: ['addObject', 'deleteObject', 'editSettings']...