diff --git a/website/src/pages/en/subgraphs/querying/managing-api-keys.mdx b/website/src/pages/en/subgraphs/querying/managing-api-keys.mdx index 0a16fca09f15..136cbf1ef657 100644 --- a/website/src/pages/en/subgraphs/querying/managing-api-keys.mdx +++ b/website/src/pages/en/subgraphs/querying/managing-api-keys.mdx @@ -26,6 +26,40 @@ A new window will pop up: ![Create API Key Window](/img/create-api-key.png) +## Using Your API Key + +> [!IMPORTANT] Always keep your API key in environment variables or a secure secrets manager. Do not hardcode it in your codebase or expose it in client-side apps. + +When you query The Graph from your dapp, you can use your API key in two ways: + +1. In the URL (optimal method for Subgraph queries): + + Include the API Key directly to your query endpoint: + + ``` + https://gateway.thegraph.com/api//subgraphs/id/ + ``` + +2. As a bearer Token: + + Include your API Key in the `Authorization` request header for added security: + + ``` + Authorization: Bearer + ``` + + Curl command example: + + ``` + curl -X POST \ + -H "Content-Type: application/json" \ + -H "Authorization: Bearer {api-key}" \ + -d '{"query": "{ graphNetworks(first: 5) { id controller graphToken epochManager } graphAccounts(first: 5) { id names { id } defaultName { id } createdAt } }", "operationName": "Subgraphs", "variables": {}}' \ + https://gateway.thegraph.com/api/subgraphs/id/DZz4kDTdmzWLWsV373w2bSmoar3umKKH9y82SUKr5qmp + ``` + +Check out [Querying from an App](/subgraphs/querying/from-an-application) for more details. + ## Manage API Keys The “API keys” table lists existing API keys and allows you to manage or delete them. For each key, you can see its status, the cost for the current period, the spending limit for the current period, and the total number of queries.