Hi Team,
Quick question on API keys & frontend...
# permit-saasl
Lau Charles
12/31/2025, 6:13 AMHi Team,
Quick question on API keys & frontend integration:
Is there any support for read-only / GET-only API keys (or scoped tokens) in Permit? If not, what is the recommended pattern when frontend applications need to integrate with Permit (e.g. checking permissions) without exposing management-level access?
a
Ask Inkeep
12/31/2025, 6:13 AMHi @Lau Charles, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
Ask Inkeep
12/31/2025, 6:14 AM*
Based on the available documentation, there isn't explicit support for read-only or GET-only scoped API keys. However, there are recommended patterns for frontend integration that avoid exposi
Ask Inkeep
12/31/2025, 6:14 AMTo learn more, see the sources I considered: [[1] CASL](https://docs.permit.io/integrations/feature-flagging/casl) [[2] Step-By-Step Tutorial: Frontend Authorization with Next.js and CASL](https://www.permit.io/blog/frontend-authorization-with-nextjs-and-casl-tutorial) [[3] FoAz: Frontend Only Authorization](https://www.permit.io/foaz)
o
Or Weis
12/31/2025, 6:49 AMHi there @Lau Charles, 🤗
thanks for reaching out.
putting any keys in frontend is a security issue and anti pattern even readonly
the recommended pattern is the bff (backend for frontend) pattern- in which you have a login protected backend routes wrap usage of the api for the frontend.
Or Weis
12/31/2025, 6:50 AMour frontend guide covers this-
https://docs.permit.io/integrations/feature-flagging/casl#create-an-api-route-to-handle-the-permissions-checks
Or Weis
12/31/2025, 6:51 AMnote that the FoAz feature mentioned by the AI has been deprecated
7 Views