Keep your key on your server
Before your users reach the relay, check their session, cap the request size, validate the query, set a rate limit per user, and put a timeout on the call to Fellowverse.
A key in an Android or iOS app, or in a web page, can be read by anyone who has the app. Call Fellowverse from your own server instead, and have your app call your server. Your server holds the key, decides who may search, and can cache popular results.
A minimal relay in Node 18 or later, with no dependencies:
import { createServer } from 'node:http';
const KEY = process.env.FELLOWVERSE_KEY; // fv_live_... or fv_test_...
createServer(async (req, res) => {
if (req.method !== 'POST' || req.url !== '/search') {
res.writeHead(404).end();
return;
}
// Check your own user's session here before spending a request.
let body = '';
for await (const chunk of req) body += chunk;
const { query } = JSON.parse(body || '{}');
const upstream = await fetch('https://play.fellowverse.app/v1/search', {
method: 'POST',
headers: { authorization: `Bearer ${KEY}`, 'content-type': 'application/json' },
body: JSON.stringify({ query, limit: 10 }),
});
res.writeHead(upstream.status, { 'content-type': 'application/json' });
res.end(await upstream.text());
}).listen(8080);
Use one key per server or environment, named for it in the console ("android backend", "staging"), so you can see which one is in use and replace one without touching the others.
Need the contract? Download OpenAPI. Manage keys and account access in the developer console.