Use the database API

Choose the right API#

For website records, start with Build a custom database at /docs/custom-database-api. It covers the beginner visual editor, ready-to-upload contact form, and visitor-owned notes example. Your website loads /__cloudauro/data.js and uses CloudAuroData with no secret key. Table access rules are enforced by the server.

For private inbox access, add a row in Staff login table and use the staff authentication endpoints. Keep passwords out of ordinary custom records. Static website files remain public.

Trusted server integrations#

The older bearer-token API remains supported for your own trusted server or integration. Create a database-scoped token under the project's advanced API tools, choose read/write/delete permissions as needed, and keep it outside public files. Tokens expire after 30 days and can be revoked immediately. Tokens can access all permitted rows in their database, including member-owned rows; they do not act as a website visitor. Do not put even a read-only token into public JavaScript when the database contains private information.

// Trusted server JavaScript, never a hosted browser script.
const databaseId = process.env.CLOUDAURO_DATABASE_ID;
const tableId = process.env.CLOUDAURO_TABLE_ID;
const token = process.env.CLOUDAURO_DATA_TOKEN;
const response = await fetch(
  `https://cloudauro.com/api/data/${databaseId}/tables/${tableId}/rows?page=1&limit=25`,
  {headers: {Authorization: `Bearer ${token}`}}
);
const envelope = await response.json();
if (!response.ok) throw new Error(envelope.error?.message || 'Data request failed');
console.log(envelope.data.items);

Use the canonical management API origin configured by your CloudAuro operator. GET lists rows or fetches /rows/ROW_ID. POST creates with {"values": {...}}. PATCH /rows/ROW_ID merges provided values, preserving others. DELETE removes a row. Mutations need their corresponding token permissions. Browser-origin CORS remains limited to the linked project's assigned or verified domains, but CORS is not a substitute for protecting tokens.

Management API for custom schemas#

A signed-in CloudAuro customer uses /api/websites/SITE_ID/database or /api/databases to create a project database; with template empty, tables can be defined in the same request. GET /api/databases/DATABASE_ID/schema returns definitions and approximate stored JSON usage. Manage tables at /api/databases/DATABASE_ID/tables and /tables/TABLE_ID. Management mutations require the customer session and X-CSRF-Token from /api/auth/csrf. Anonymous visitors cannot create tables or alter schemas.

Query limits and errors#

Lists use page and limit, default 25 and maximum 100, with page capped at 10000. One typed equality filter uses field=FIELD&equals=JSON_VALUE. sort=FIELD orders ascending and sort=-FIELD descending. JSON fields cannot be filtered or sorted. Unknown fields and unsafe schema changes are rejected. Each database permits 20 tables, 20 fields/table and 10000 rows/table; row JSON is limited to 64 KiB and account storage is enforced. Stored values are untrusted; render with textContent, not innerHTML. Complete endpoint documentation is available at /api/openapi.json.