← Zurück zum Blog

Session tokens for CDN search — keep API keys off the page

securityembed

The anti-pattern

Putting data-aac-key="aac_live_…" in HTML lets anyone scrape your index, burn quota, or write documents if the key is too wide.

The pattern

  1. On your backend, POST /api/v1/embed/session with a server-side API key.
  2. Return the session token to the page.
  3. Load the CDN script with data-aac-token (and optional mount id).

The token is search-scoped and expires. Console Embed settings (accent, facets, Related / For you) load from your origin on every page view — no redeploy.

Bonus

Pass a stable clientId when the shopper is logged in so personalization and recommendations follow them across devices.