Security

Gate collections with access rules. File uploads are on Files.

Credentials

Credential	Lives in	What a caller can do
Project JWT (type: project, 24h)	End-user app, after login	Data API, subject to rules. Satisfies requireAuth.
Service token kfxs_…	Server env only (TEFILY_SERVICE_TOKEN)	Data API and POST /api/p/:projectId/auth/verify. Bypasses rules, except an endpoint with requireServiceToken allows only this token. Cannot call console APIs.
Personal access token kfx_…	Admin scripts and MCP	Console APIs (/api/projects, schemas, hosting). Bypasses data-API rules. Does not satisfy requireAuth (it bypasses the engine). Not for auth/verify.

Caution

NEXT_PUBLIC_*, EXPO_PUBLIC_*, and --dart-define are client bundles. None of them may contain kfxs_ or kfx_.

Do	Don’t
Project JWT in the end-user app	kfxs_… or kfx_… in the app or NEXT_PUBLIC_* / EXPO_PUBLIC_*
Service token only on a server	Log service tokens or commit them
PAT for MCP and admin scripts	Share one PAT across untrusted machines without rotation

Server-only tables

For a collection only the backend should touch, on each enabled method add Require service token (requireServiceToken, empty config). Project auth does not need to be on. A project JWT, a PAT, and an anonymous caller are denied (A service token is required).

{ "ruleType": "requireServiceToken", "ruleConfig": {} }

In the console, open Database → Access Rules, select the method, Add Rule, and choose Require service token. How this differs from bypass is on Access rules. The client that is allowed to call is Backend service token.

Owner rules for a user-owned table are Auth and owner rules.

File rules on upload

Rules attach to the upload endpoint only (fileSizeLimit, fileMimeType, fileExtensionAllow). download and fileDelete still need requireAuth, and the owner compare if files belong to a user. The record must exist before upload. The client declares real contentType and size. The uploadFile sample is on Files.

In Access Rules, select the upload method and Add Rule three times:

{ "ruleType": "fileSizeLimit", "ruleConfig": { "maxBytes": 10485760 } }

{ "ruleType": "fileMimeType", "ruleConfig": { "allow": ["image/jpeg", "image/png"] } }

{ "ruleType": "fileExtensionAllow", "ruleConfig": { "extensions": [".jpg", ".jpeg", ".png"] } }

image/* is valid in allow. The reference page shows it. This recipe uses explicit types. The platform FILE_MAX_BYTES cap still applies. See Files.

CORS

Browser apps may call /api/p/... directly. Treat every collection endpoint as public to the internet, gated only by tokens and rules.