Skip to main content
Praxa credentials belong in trusted server code. A browser should call an application-specific backend route that authenticates the user, derives the workspace, validates input, and then calls Praxa with a server-only credential.

Prerequisites

Before you begin, prepare:
  • a trusted server runtime and application authentication boundary;
  • a disposable personal workspace Praxa key with only the tutorial’s required scopes;
  • synthetic input plus a persisted application request ID for replay tests;
  • a fake upstream for unit tests and a non-production environment for canaries;
  • an acceptance assertion that proves the chosen framework preserves the same server-owned credential, authority, and replay contract.

Shared boundary requirements

Every framework implementation should:
  1. Authenticate the application user before accepting work.
  2. Derive the tenant or workspace from the session, not the request body.
  3. Validate and bound user input before forwarding it.
  4. Create one stable idempotency key per logical mutation.
  5. Keep Praxa keys, OAuth tokens, provider clients, and webhook secrets server-only.
  6. Return only customer-safe Praxa projections to the browser.
  7. Rate limit by the authenticated principal and application use case.

Next.js App Router

app/api/tasks/route.ts
Do not prefix the key variable with NEXT_PUBLIC_. That would make it eligible for the client bundle.

Express

Cloudflare Workers or Hono

Store the key with wrangler secret put PRAXA_API_KEY, not in wrangler.jsonc or source control.

FastAPI

The FastAPI example hashes the authenticated user ID with the caller’s stable application request ID. That makes retries deterministic without leaking user identifiers into the upstream key. Every idempotency key must satisfy the Praxa identifier grammar.

React, Vue, and Svelte clients

Frontend frameworks use the same application backend boundary:
React, Vue, and Svelte components may call this function. They should never call api.praxa.io with a server API key or receive provider credentials.

Verify the framework boundary

  1. Search the production client bundle for praxa_sk_, webhook secrets, and OAuth tokens; require zero matches.
  2. Call the route without an application session and require 401 before any Praxa request.
  3. Send an over-limit input and require 400 before any Praxa request.
  4. Submit valid input and require a customer-safe run projection.
  5. Retry with the same application request ID and require the same logical run.
  6. Attempt to supply a tenant or workspace ID in the browser body and require it to be ignored or rejected.
  7. Revoke the backend Praxa credential and require the route to return a safe, non-secret error.

Troubleshooting

Best practices

  • Authenticate, rate-limit, and validate a bounded body before calling Praxa.
  • Derive tenant and subject from the application session, never client input.
  • Reuse clients and connection pools; set connect, request, and total deadlines.
  • Persist request identity before the first mutation and reconcile ambiguous outcomes.
  • Scan production client assets and telemetry for credential-shaped values.

Optimize for production

  • Reuse one configured HTTP or SDK client per process and bound concurrent upstream work.
  • Prefer durable admission plus asynchronous readback over holding application requests open.
  • Cache only non-sensitive, tenant-scoped reads within their documented freshness window.
  • Measure p50/p95 latency, admission-to-terminal time, retries, conflicts, and connection reuse before tuning.
Optimize only after the correctness and isolation matrix passes. Lower latency or cost is not an improvement if verified outcomes, authority checks, or recovery rates regress.

Cleanup and next steps

  1. Revoke the disposable Praxa key and require a later request to fail.
  2. Remove synthetic application records and any temporary environment files.
  3. Cancel or archive unresolved test runs according to the application policy.
  4. Retain only redacted request, run, and verification identifiers needed for the test record.
After cleanup, run the shared integration test matrix and record any environment-specific check that remains pending.

Frequently asked questions

What proves this tutorial works?

The minimum observable result is that the chosen framework preserves the same server-owned credential, authority, and replay contract. A compile, package import, mocked response, or initial admission alone does not prove the complete workflow.

Can a browser, mobile app, or model prompt hold the credential?

No. Browser and mobile bundles are inspectable. Keep the Praxa credential in the trusted application backend.

How should an ambiguous mutation be retried?

Persist the exact logical input and idempotency key before the first attempt. Reconcile through authoritative readback or replay the exact request with that same key before creating new work.

What should we monitor after release?

Monitor application auth failures, upstream status/code, latency, retries, replay conflicts, and terminal run outcomes. Alert on authorization bypass, cross-tenant disclosure, repeated conflicts, or cleanup failure.
Last modified on August 14, 2026