API Security & Origin Control
Browse detailed audit trails for operations, updates, file accesses, and config changes.
Overview
The API Security & Origin Control page provides administrators with tools to secure workspace APIs, monitor incoming API requests, and detect suspicious or excessive traffic.
It helps ensure that only trusted client applications can access your APIs while providing real-time visibility into API usage and potential security threats.
The page consists of three sections:
- Origin Whitelist Settings
- Real-Time API Access Auditor
- Rate Limit Intruder Alerts
Origin Whitelist Settings
The Origin Whitelist restricts browser-based API requests to a list of trusted domains.
When configured, CoconutDB validates the request origin before processing API calls. Requests originating from domains that are not included in the whitelist are automatically rejected.
This helps protect your APIs from unauthorized websites and Cross-Origin Resource Sharing (CORS) abuse.
Configuration
Enter one or more allowed domains separated by commas.
Example
`localhost:5173, app.company.com, portal.company.com`
If the whitelist is left empty, requests from any origin are permitted.
Benefits
- Restricts browser-based API access.
- Prevents unauthorized websites from calling your APIs.
- Improves API security.
- Simplifies CORS management.
Real-Time API Access Auditor
The Real-Time API Access Auditor provides a live audit trail of API requests processed by the workspace.
Each request records important information including:
- Timestamp
- User
- HTTP Method
- API Endpoint
This allows administrators to monitor API activity, troubleshoot integrations, and investigate unexpected behavior.
Common Use Cases
- Monitor API usage.
- Verify successful API calls.
- Investigate failed requests.
- Troubleshoot application integrations.
- Review developer activity.
Rate Limit Intruder Alerts
The Rate Limit Intruder Alerts panel identifies users or clients that have exceeded the configured API rate limits.
When a client generates excessive requests within a short period, CoconutDB temporarily blocks additional requests to protect the platform from abuse and maintain system stability.
Blocked users or API clients are displayed in this section for administrative review.
Benefits
- Detects excessive API traffic.
- Protects against abuse and denial-of-service attempts.
- Prevents accidental request flooding.
- Improves platform stability.
If no clients have exceeded the configured limits, the panel indicates that there are currently no active rate-limit blocks.