Recipe · Auth

Add Bearer token auth to your mock API

Q: What format is the token?

An opaque random string you send verbatim after `Bearer `. It's not a JWT — there are no claims to decode, which is exactly what you want for a mock.

Your frontend needs to prove it sends the token, your tests need to assert the 401, and you'd rather not stand up a real auth server. One Bearer key on the project does all of it.

Updated June 7, 20264 min

One key flips the lock

The rule is deliberately simple: zero keys on a project → every endpoint is public. One or more keys → every endpoint requires a valid `Authorization: Bearer` header. There's no per-route config to forget.

authorised request

GET /m/you/shop/productsAuthorization: Bearer ms_live_8f3a91c4e7b2…

Create a key

Open the project

Go to your project, find the API keys section.

Generate

Create a key. The token is shown once — copy it now, only its hash is stored.

Send it

Add the Authorization: Bearer header to your client. Every route is now protected.

The 401s you can test against

Two distinct failure shapes, both 401, so your error handling can tell them apart:

missing header

{ "error": "Clé d'API requise : en-tête « Authorization: Bearer <token> »" }

wrong key

{ "error": "Clé d'API invalide" }

Stored as a hash, shown once

Only a SHA-256 hash of the token lives in the database — the plaintext is never persisted. Lost a key? You can't recover it; revoke it and mint a new one. Several keys can coexist, so rotation is painless.

Each key gets its own budget

Requests are rate-limited per project and per caller — identified by the key's hash when present, otherwise by IP. The ceiling is 60 requests/minute on free, 600/minute on Pro. Over the limit you get a 429 with a Retry-After header.

Frequently asked

Can I keep some routes public and protect others?

Not within one project — the key applies to the whole project. Split public and protected resources into two projects if you need both.

What format is the token?

An opaque random string you send verbatim after Bearer . It's not a JWT — there are no claims to decode, which is exactly what you want for a mock.

Does removing all keys make it public again?

Yes. Delete every key and the project flips back to public on the next request. The switch is purely « does at least one key exist ».

Stop waiting on the backend.

Forge your own mock API in two minutes. Free, up to two projects, no credit card.

Forge a free mock

How to mock a paginated REST API (no backend)

Build a fake REST endpoint with real pagination — page, limit, total and totalPages — and wire an infinite scroll against stable data.

4 min

Comparison

A hosted json-server alternative (no install, real data)

json-server is great locally. When you need a shared URL, realistic data and relations without maintaining a db.json, a hosted mock is the better fit.

5 min