Skip to main content

Dev-server keys

kura start generates one kura_dev_… credential for the local instance. It is a server-only service credential: it is distinct from the publishable project key, the gateway signer, browser sessions, and the Dashboard's local operator proxy.

The value is retained in the local Docker state volume and is deliberately absent from kura status, public instance metadata, browser storage, and the Dashboard bundle. Request it explicitly only when a trusted local server needs service access:

pnpm kura key dev

The command prints an environment assignment. Put it only in a server environment such as .env.local:

KURA_URL=http://127.0.0.1:55422
KURA_DEV_SERVER_KEY=kura_dev_replace_with_the_command_output

Use the administrative gateway URL for service operations. A normal application client should instead use the application gateway URL and the publishable project key.

app/api/admin/route.ts
import { createClient } from '@kurabase/js'

const admin = createClient(
  process.env.KURA_URL!,
  process.env.KURA_DEV_SERVER_KEY!,
)

const result = await admin.admin.sql('select 1 as healthy')
Never send this key to a browser

The key authorizes a trusted dev server to use the local delegated operator. It can bypass RLS on the privileged gateway, so it must not be included in NEXT_PUBLIC_*, VITE_*, client bundles, commit history, logs, or a browser request.

kura db reset --yes replaces the local instance and therefore generates a new dev-server key. There is currently one local development key per instance; named keys, rotation without reset, and hosted key lifecycle are not implemented yet.