Base Authentication: Methods, Credentials, & Security Best Practices

Authentication overview

Base provides a no-code/low-code platform for building data-driven applications and automating workflows. While its primary interface is visual, it also offers programmatic access through its API for integration with external systems, custom frontends, or automated scripts. Authentication for these API interactions is managed through API tokens, which serve as the primary mechanism for verifying the identity and permissions of a requesting client.

API tokens are long, randomly generated strings that grant access to specific resources or operations within a Base application. When an API request is made, the token is included in the request headers, allowing the Base backend to validate the requestor's identity and authorize the intended action against the configured permissions for that token. This approach simplifies access management for developers and system integrators, enabling secure programmatic interaction without requiring complex OAuth flows for server-to-server communication or internal tools.

It is crucial to manage these API tokens securely, as their compromise could lead to unauthorized access to your Base data and applications. Best practices involve treating tokens as sensitive credentials, similar to passwords, and implementing measures to prevent their exposure in codebases, logs, or version control systems. The Base platform itself runs on modern web infrastructure, leveraging Transport Layer Security (TLS) to encrypt all data in transit, further protecting API communications from eavesdropping.

Supported authentication methods

Base primarily supports API token authentication for programmatic access to its platform. This method is common for backend-to-backend communication, scripting, and integrating with other services where a user-centric OAuth flow is not necessary or practical. OAuth 2.0 is an authorization framework that allows third-party applications to obtain limited access to a user's service without exposing their credentials, as detailed in the OAuth 2.0 specification. However, Base's API tokens are designed for direct application-level access, configured and managed within the Base dashboard.

API Token Authentication

API tokens in Base are unique identifiers associated with your account or a specific application within your Base workspace. They are used to authenticate requests to the Base API. Each token can be configured with specific permissions, limiting its access to certain tables, records, or operations (e.g., read-only access, read/write access). This granular control allows you to create tokens with the minimum necessary privileges, adhering to the principle of least privilege.

When to use API token authentication:

• Server-side applications: For backend services that need to interact with your Base data (e.g., a custom CRM pulling customer data).
• Automated scripts: When running cron jobs or scripts to update data, generate reports, or trigger workflows in Base.
• Integrations: Connecting Base with other platforms or services that require direct API access.
• Internal tools: Building custom internal dashboards or tools that need to read from or write to Base.

The following table summarizes the primary authentication method supported by Base:

Getting your credentials

To obtain an API token for your Base account, you typically navigate through the Base dashboard. The process involves generating a new token and, optionally, configuring its permissions. While the exact navigation path may vary slightly with product updates, the general steps described below are standard for obtaining your credentials.

Steps to generate an API Token:

1. Log in to your Base account: Access your Base dashboard using your username and password at Base's homepage.
2. Navigate to 'Settings' or 'API Access': Look for a section related to API keys, integrations, or developer settings. This is often found under your workspace settings or profile menu.
3. Generate a new API token: Within the API access section, there should be an option to create or generate a new API token. You may be prompted to give the token a descriptive name, which helps in identifying its purpose later.
4. Configure token permissions (if available): Base allows you to define the scope of access for each token. This might include specifying which tables the token can access, whether it has read-only or read-write privileges, and other granular permissions. Always grant the minimum necessary permissions to adhere to the principle of least privilege.
5. Copy the API token: Once generated, the API token will be displayed. This is usually the only time you will be able to see the full token string. Copy it immediately and store it securely, as you will not be able to retrieve it again if you lose it.
6. Store securely: Store the API token in a secure location, such as an environment variable or a secrets management service, rather than hardcoding it directly into your application's source code.

For detailed, up-to-date instructions, refer to the official Base documentation accessible from your dashboard or support resources.

Authenticated request example

When making an authenticated request to the Base API, the API token is typically included in the HTTP Authorization header using the Bearer scheme. This is a common practice for token-based authentication, as described by the RFC 6750 Bearer Token Usage specification.

Here's an example using curl to fetch data from a hypothetical Base endpoint. Replace YOUR_API_TOKEN with your actual Base API token and YOUR_BASE_ENDPOINT with the specific API endpoint you wish to access (e.g., for a particular table or record).

curl -X GET \
  'https://api.base.ai/v1/your-app-id/your-table-id/records' \
  -H 'Authorization: Bearer YOUR_API_TOKEN' \
  -H 'Content-Type: application/json'

In this example:

• -X GET specifies the HTTP method (GET for retrieving data).
• 'https://api.base.ai/v1/your-app-id/your-table-id/records' is the target API endpoint. You'll need to obtain the correct endpoint URL specific to your Base application and table from your Base API documentation.
• -H 'Authorization: Bearer YOUR_API_TOKEN' is the crucial part for authentication. It sends your API token in the Authorization header, prefixed with Bearer .
• -H 'Content-Type: application/json' informs the server that the request body (if any) is in JSON format, though it's often optional for GET requests.

For more complex interactions, such as creating or updating records, you would adjust the HTTP method (e.g., POST or PUT) and include a JSON request body with the data you wish to send.

Security best practices

Securing your API tokens is paramount to maintaining the integrity and confidentiality of your data within Base. Adhering to these best practices will help prevent unauthorized access and mitigate potential security risks.

1. Treat API Tokens as Sensitive Credentials

API tokens grant direct access to your Base resources. Treat them with the same level of care as you would a password. Avoid hardcoding tokens directly into source code, committing them to version control systems (like Git, even in private repositories), or exposing them in client-side code where they could be easily extracted.

2. Use Environment Variables for Storage

The recommended way to manage API tokens in development and production environments is through environment variables. This approach keeps tokens separate from your codebase, making them easier to manage and update without modifying code, and preventing their accidental exposure in code repositories or logs.

Example (Node.js):

// Access token from environment variable
const API_TOKEN = process.env.BASE_API_TOKEN;

Example (Python):

# Access token from environment variable
import os
API_TOKEN = os.environ.get('BASE_API_TOKEN')

3. Implement Principle of Least Privilege

When generating API tokens within the Base dashboard, configure their permissions to grant only the minimum necessary access required for their intended function. For instance, if a token is only needed to read data from a specific table, do not grant it write access or access to other tables.

4. Rotate Tokens Regularly

Periodically rotate your API tokens. This means generating new tokens and revoking old ones. Regular rotation minimizes the window of opportunity for a compromised token to be exploited, even if the compromise goes unnoticed. Establish a rotation schedule that makes sense for your security policies and operational needs.

5. Monitor API Usage

Regularly review API access logs or usage analytics provided by Base. Unusual patterns of activity (e.g., high volume of requests from unexpected locations, access to unauthorized resources) could indicate a compromised token or malicious activity. Implement alerts for suspicious behaviors if Base offers such capabilities.

6. Secure Your Development Environment

Ensure that your development machines and build pipelines are secure. Malicious software or improper access controls on developer workstations could expose API tokens. Use secure coding practices and maintain up-to-date security software.

7. Use HTTPS/TLS

All communication with the Base API should occur over HTTPS (HTTP Secure) to ensure that data in transit, including API tokens, is encrypted using TLS. Base infrastructure inherently enforces this, but always verify that your client-side implementations are making requests to https:// endpoints to prevent man-in-the-middle attacks.

8. Revoke Compromised Tokens Immediately

If you suspect an API token has been compromised, revoke it immediately within the Base dashboard. After revocation, generate a new token with appropriate permissions and update any applications or scripts that were using the compromised token. Swift action is critical to limit potential damage.

9. Control Access to the Base Dashboard

The Base dashboard is where API tokens are managed. Implement strong access controls for your Base account itself, including strong, unique passwords and, if available, multi-factor authentication (MFA). Limiting who can generate, view, or revoke API tokens is a foundational security measure.