Authentication

All EdgeWrap API access is authenticated using Server API Keys. You create and manage these keys directly from your EdgeWrap dashboard — no login or signup API is required.

Warning: No Login / Signup API: EdgeWrap does not expose a login or signup API endpoint. Access to all APIs is gated by a Server API Key that you generate from your project dashboard at app.edgewrap.pro.

Server API Keys

A Server API Key is a long-lived credential that authenticates your application or server when calling any EdgeWrap API. You must create at least one Server API Key from the dashboard before making any API requests.

Creating a Server API Key

  1. Log in to the EdgeWrap Dashboard at app.edgewrap.pro.
  2. Navigate to your project and open the API Keys tab.
  3. Click Create API Key and choose the Server platform type.
  4. Give the key a descriptive name (e.g. Production Server).
  5. Click Generate and copy the key immediately — it will only be shown once.
Warning: Copy your Server API Key immediately after creation. For security reasons, the full key value is only shown once and cannot be retrieved later.

Authenticating Proxy Requests (x-api-key)

To route traffic through the EdgeWrap gateway to your origin, attach your Server API Key in the x-api-key header with every request.

Send a request through the edge proxy
curl https://{your-project}.edgewrap.pro/v1/products \
  -H "x-api-key: ek_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"

Authenticating Management API Requests

Administrative operations — such as creating projects, reading analytics, or updating WAF rules programmatically — also use your Server API Key. Pass it in the x-api-key header when calling the management API.

Authenticate a management API request
curl https://server.edgewrap.pro/v1/projects \
  -H "x-api-key: ek_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"

API Key Properties

When creating a Server API Key in the dashboard, you can configure these properties to control access and protect against misuse:

  • Environment: Scoped to live or test environments — test keys have separate usage caps.
  • Platform: Set to Server for server-to-server communication. Server keys require an additional secret (x-api-secret) for double verification.
  • Rate Limits: Configure custom requests-per-minute (RPM) limits and daily request caps on a per-key basis.
  • IP Allowlist: Restrict which server IPs are permitted to use the key for added security.

Forwarding Client Authorization Headers

EdgeWrap acts as a transparent proxy. If your client applications include their own Authorization header (e.g. Authorization: Bearer <user-token>), EdgeWrap will validate the x-api-keyat the gateway and forward the client's Authorization header untouched to your origin.

Clientx-api-key: ek_...
Authorization: Bearer jwt_...
→
EdgeWrap GatewayValidates x-api-key
→
Your BackendAuthorization: Bearer jwt_...
Tip: Security Best Practice: Never expose your Server keys in client-side applications (browsers or mobile apps). Use Web-scoped keys with strict CORS origin allowlists for client-facing traffic instead.