API Authentication Guide

Understand authentication patterns for video player APIs, public iframe embeds, private keys, and backend proxying.

Developer intent

Choose the right authentication model for public embeds, private dashboards, and server-side API calls.

Public embeds

Iframe embeds can be public when they do not expose private user data.

Backend keys

Private provider keys should stay on your backend and never be placed in browser code.

Future-proofing

If you add private analytics or dashboards, protect those routes with account authentication.

Example

// Public player embed
<iframe src="https://www.vidcore.org/embed/movie/27205" />

// Private keys belong server-side only
process.env.TMDB_API_KEY