Bored Authentication: API Key Security and Setup (2026)

Authentication overview

Bored, a platform for API mocking and testing, secures access to its services and user-defined mock APIs primarily through API keys. These keys serve as a credential to authenticate requests made to the Bored management API and to access private mock endpoints. The authentication mechanism is designed to be straightforward, enabling developers to quickly integrate mocked services into their development and testing workflows while maintaining a level of access control.

When interacting with the Bored platform, an API key is required to perform actions such as creating new mocks, updating existing ones, or retrieving configuration details. For mock endpoints that are configured as private, clients consuming these mocks will also need to provide the API key to receive responses. This approach ensures that only authorized applications or users can access and manipulate the mock data and service configurations.

Security for API keys, as with any credential, relies on careful management and protection against unauthorized disclosure. Bored's documentation provides specific guidance on how to generate, use, and revoke API keys, emphasizing secure practices to prevent misuse and maintain the integrity of your mocked environments. All communication with Bored's API is expected to occur over HTTPS, encrypting data in transit and protecting API keys from interception during transmission.

Supported authentication methods

Bored supports API key authentication as its primary method for securing access to both its management API and private mock endpoints. This method is widely adopted due to its simplicity and effectiveness in controlling access to resources. API keys are long, randomly generated strings that act as a secret token.

When an API key is used, it is typically included in the request headers or, in some cases, as a query parameter. Bored's recommended approach is to transmit the API key in the Authorization header using the Bearer scheme, which is a common practice for token-based authentication in RESTful APIs. This method helps to keep the API key separate from the URL, reducing the risk of it being logged or exposed in browser histories or server logs more broadly than necessary.

The table below summarizes the supported authentication method:

While API keys offer a practical solution for authentication, their security heavily depends on how they are stored and transmitted. Best practices, such as transmitting keys over HTTPS and avoiding hardcoding them directly into client-side code, are crucial for maintaining the security of your Bored mocks and data. For more details on API key security, refer to the Bored API reference on authentication.

Getting your credentials

To obtain your Bored API key, you will need to access your account dashboard on the Bored website. The process typically involves logging into your account and navigating to a section dedicated to API settings or personal access tokens.

1. Log in to your Bored Account: Go to the Bored homepage and sign in with your registered credentials.
2. Navigate to API Settings: Once logged in, locate the 'Settings' or 'API Keys' section within your user dashboard. This is usually accessible from a profile menu or a dedicated developer section.
3. Generate a New API Key: Within the API settings, there should be an option to generate a new API key. You may be prompted to give the key a descriptive name to help you identify its purpose later, especially if you plan to use multiple keys for different applications or environments.
4. Copy Your API Key: After generation, the API key will be displayed. It is critical to copy this key immediately and store it securely, as it may only be shown once. If you lose it, you might need to revoke it and generate a new one.

Bored's documentation provides a step-by-step guide for generating and managing API keys, including instructions on how to revoke keys that are no longer needed or that may have been compromised. Regularly reviewing and rotating your API keys is a recommended security practice to mitigate potential risks.

Authenticated request example

When making authenticated requests to Bored's API or to private mock endpoints, your API key must be included in the request. The standard method is to use the Authorization header with the Bearer scheme. Below is an example of an authenticated request using curl to a hypothetical private mock endpoint /my-private-mock.

curl -X GET \
  https://api.bored.dev/my-private-mock \
  -H "Authorization: Bearer YOUR_BORED_API_KEY" \
  -H "Content-Type: application/json"

In this example:

• -X GET specifies the HTTP method, which is GET in this case.
• https://api.bored.dev/my-private-mock is the URL of the private mock endpoint you are trying to access.
• -H "Authorization: Bearer YOUR_BORED_API_KEY" is the critical part for authentication. You must replace YOUR_BORED_API_KEY with the actual API key you obtained from your Bored dashboard. The Bearer prefix is essential for the server to correctly interpret the token.
• -H "Content-Type: application/json" specifies the content type of the request body, though it might not be strictly necessary for a GET request, it's good practice to include it.

For more complex interactions, such as creating or updating mocks using the Bored management API, the request body might contain JSON data. The authentication header remains the same. Always ensure your API key is correctly formatted and included in the Authorization header for successful authentication.

Security best practices

Securing your API keys for Bored is crucial for protecting your mock environments and preventing unauthorized access. Implementing robust security practices helps mitigate risks associated with credential exposure. The following best practices are recommended:

1. Treat API Keys as Sensitive Credentials: Your Bored API key provides access to your mock configurations and private data. Treat it with the same level of security as you would a password or other sensitive access tokens. Avoid embedding API keys directly into client-side code where they could be easily extracted.
2. Use Environment Variables: Instead of hardcoding API keys in your application's source code, store them in environment variables. This practice ensures that keys are not committed to version control systems (like Git) and can be managed separately for different deployment environments (development, staging, production). For instance, in Node.js, you might access it via process.env.BORED_API_KEY.
3. Transmit Over HTTPS Only: Always ensure that all communications with Bored's API occur over HTTPS (TLS/SSL). This encrypts the data in transit, protecting your API key from interception by malicious actors during network communication. Bored's API endpoints are designed to enforce HTTPS, but it's important to verify your client configurations. The IETF RFC 7230 on HTTP/1.1 Message Syntax and Routing emphasizes the importance of secure transport.
4. Implement Least Privilege: If Bored offers granular permissions for API keys (e.g., read-only vs. read-write access), generate keys with only the minimum necessary permissions required for a specific task or application. This limits the potential damage if a key is compromised.
5. Regularly Rotate API Keys: Periodically generate new API keys and revoke old ones. This practice, known as key rotation, reduces the window of opportunity for a compromised key to be exploited. A common recommendation is to rotate keys every 90 days, or more frequently if a security incident is suspected.
6. Monitor API Key Usage: Keep an eye on your API key usage patterns. Unusual spikes in requests, requests from unexpected geographical locations, or attempts to access unauthorized resources could indicate a compromised key. Bored's dashboard may offer logging or monitoring features to help with this.
7. Secure Your Development Environment: Ensure that your local development environment and CI/CD pipelines are secure. Access to configuration files or environment variables that store API keys should be restricted.
8. Avoid Public Repositories: Never commit API keys, even commented out, to public code repositories like GitHub or GitLab. Tools exist to scan repositories for leaked credentials, but prevention is the best approach.

By diligently following these security best practices, you can significantly enhance the protection of your Bored API keys and the integrity of your mocked API environments.