Search code examples
javascriptnode.jssecurityapi-keyalgolia

Algolia generate Invalid Secured API-Keys


So I'm trying to generate some secured API-Keys but it seems that they aren't generated right, I've followed the API docs without any luck.

This is what I'm doing

var algoliasearch = require('algoliasearch');

var admin_client = algoliasearch('APP', 'ADMIN_KEY');
var search_client = algoliasearch('APP', 'ONLY_SEARCH_KEY');

var admin_index = admin_client.initIndex('INDEX');
var search_index = search_client.initIndex('INDEX');

admin_index.search('dav', (err, content) => { console.log(err, content) });
//------------------CONSOLE-------------------------------
null { hits: 
[ { firstname: 'David',
   lastname: 'De Anda',
   _tags: [Object],
   objectID: '2',
   _highlightResult: [Object] } ],
nbHits: 1,
page: 0,
nbPages: 1,
hitsPerPage: 20,
processingTimeMS: 1,
query: 'dav',
params: 'query=dav' }
//-------------------------------------------------

search_index.search('dav', (err, content) => { console.log(err, content) });

//------------------CONSOLE-------------------------------
null { hits: 
[ { firstname: 'David',
   lastname: 'De Anda',
   _tags: [Object],
   objectID: '2',
   _highlightResult: [Object] } ],
nbHits: 1,
page: 0,
nbPages: 1,
hitsPerPage: 20,
processingTimeMS: 1,
query: 'dav',
params: 'query=dav' }
//-------------------------------------------------

Everything seems to work until now But now I want to generate some Secured API-Keys

var valid_until = Math.floor(Date.now() / 1000) + 3600

var from_admin_api_key = admin_client.generateSecuredApiKey('from_admin', {validUntil: valid_until});
var from_search_api_key = search_client.generateSecuredApiKey('from_search', {validUntil: valid_until});

var sub_admin_client = algoliasearch('APP', from_admin_api_key);
var sub_search_client = algoliasearch('APP', from_search_api_key);

var sub_admin_index = sub_admin_client.initIndex('INDEX');
var sub_search_index = sub_search_client.initIndex('INDEX');

sub_admin_index.search('dav', (err, content) => { console.log(err, content) });
//------------------CONSOLE-------------------------------
{ Error
    at success (/app/node_modules/algoliasearch/src/AlgoliaSearchCore.js:334:32)
    at process._tickDomainCallback (internal/process/next_tick.js:129:7)
  name: 'AlgoliaSearchError',
  message: 'Invalid Application-ID or API key',
  debugData: 
   [ { currentHost: 'https://ge24e6css9-dsn.algolia.net',
       headers: [Object],
       content: '{"params":"query=dav"}',
       contentLength: 22,
       method: 'POST',
       timeouts: [Object],
       url: '/1/indexes/INDEX/query',
       startTime: 2017-01-13T17:46:42.519Z,
       endTime: 2017-01-13T17:46:44.038Z,
       duration: 1519,
       statusCode: 403 } ],
  statusCode: 403 } undefined
//-------------------------------------------------

sub_search_index.search('dav', (err, content) => { console.log(err, content) });

//------------------CONSOLE-------------------------------
{ Error
    at success (/app/node_modules/algoliasearch/src/AlgoliaSearchCore.js:334:32)
    at process._tickDomainCallback (internal/process/next_tick.js:129:7)
  name: 'AlgoliaSearchError',
  message: 'Invalid Application-ID or API key',
  debugData: 
   [ { currentHost: 'https://ge24e6css9-dsn.algolia.net',
       headers: [Object],
       content: '{"params":"query=dav"}',
       contentLength: 22,
       method: 'POST',
       timeouts: [Object],
       url: '/1/indexes/INDEX/query',
       startTime: 2017-01-13T17:46:42.519Z,
       endTime: 2017-01-13T17:46:44.038Z,
       duration: 1519,
       statusCode: 403 } ],
  statusCode: 403 } undefined
//-------------------------------------------------

Solution

  • I misunderstood the generateSecuredApiKey first parameter that actually was the origin API Key.

    So the right code will be

    var from_admin_api_key = admin_client.generateSecuredApiKey('ADMIN_KEY', {validUntil: valid_until});
    var from_search_api_key = search_client.generateSecuredApiKey('ONLY_SEARCH_KEY', {validUntil: valid_until});
    

    And of course the generated key form the ADMIN_KEY won't work.