jsDelivr Authentication: API Access and Security (2026)

Authentication overview

jsDelivr operates primarily as a global Content Delivery Network (CDN) for open-source projects, serving billions of requests monthly without requiring authentication for content retrieval. This public-facing model ensures that developers and users can access libraries, frameworks, and other assets without any access barriers. However, for specific administrative functions related to a user's projects or assets, such as programmatically purging cached content or interacting with advanced API features, jsDelivr implements an authentication layer. This layer ensures that only authorized users can perform actions that modify or manage their hosted content and configurations.

The authentication process for jsDelivr's administrative APIs is designed to be straightforward, typically relying on API tokens or keys. These credentials act as proof of identity and authorization, allowing the API to verify the sender of a request and grant appropriate permissions. The security of these tokens is paramount, as their compromise could lead to unauthorized management of associated projects. jsDelivr's API documentation provides detailed guidance on how to generate, use, and secure these credentials, emphasizing the importance of secure handling practices to protect against unauthorized access to administrative capabilities.

Understanding the distinction between public content access and authenticated administrative access is key to effectively utilizing jsDelivr. While the vast majority of interactions with jsDelivr involve unauthenticated content delivery, developers needing to automate tasks or integrate jsDelivr's management features into their workflows will engage with the authenticated API endpoints. This dual approach balances ease of access for public content with robust security for administrative operations, aligning with common practices for secure API design as outlined by organizations like the World Wide Web Consortium on web architecture.

Supported authentication methods

jsDelivr primarily supports API tokens (often referred to as API keys) for authenticating administrative requests to its API. This method involves generating a unique, secret string that is then included with each API request to prove the sender's identity and authorization. The simplicity and effectiveness of API tokens make them a common choice for securing access to web services and APIs, particularly for programmatic interactions.

The following table outlines the primary authentication method supported by jsDelivr for administrative API access:

API tokens are typically long, randomly generated strings that grant specific permissions. When making an API request, this token is usually passed in an HTTP header, such as Authorization: Bearer YOUR_API_TOKEN, or as a query parameter. The server then validates the token against its records to determine if the request is legitimate and if the token holder has the necessary permissions to perform the requested action. This mechanism is a foundational element in many API security models, ensuring that only authorized entities can initiate changes or access sensitive information via the API.

Getting your credentials

To obtain the necessary credentials for authenticating with jsDelivr's administrative API, you will typically need to generate an API token or key through your jsDelivr account interface. The process generally involves accessing your account settings or a dedicated API management section within the jsDelivr platform. While jsDelivr's core CDN functionality for serving open-source content does not require user accounts or authentication, administrative actions necessitate a registered user profile.

Steps to obtain an API token:

1. Create or Log In to your jsDelivr Account: If you don't already have one, you will need to create an account on the jsDelivr website. If you have an existing account, log in using your credentials.
2. Navigate to API Settings: Once logged in, locate the section related to API access, API keys, or developer settings. The exact path may vary but is usually found under your profile settings or a dedicated 'API' tab. Refer to the official jsDelivr API documentation for the most up-to-date navigation instructions.
3. Generate a New API Token: Within the API settings, there should be an option to generate a new API token or key. You may be prompted to give the token a descriptive name (e.g., "My CI/CD Token") and define its permissions or scope, if applicable. It is a best practice to grant only the minimum necessary permissions to a token.
4. Securely Store Your Token: Once generated, the API token will be displayed. This is usually the only time you will see the full token, so it is crucial to copy it immediately and store it securely. Do not embed it directly into client-side code, commit it to public repositories, or share it unnecessarily.
5. Understand Token Expiration (if applicable): Some API tokens may have an expiration date or can be manually revoked. Familiarize yourself with jsDelivr's policies regarding token lifecycle management to ensure continuous API access and maintain security.

By following these steps, you can acquire the necessary API token to authenticate your requests to jsDelivr's administrative endpoints, enabling programmatic control over your hosted assets and configurations. Always prioritize the secure handling and storage of these tokens to prevent unauthorized access.

Authenticated request example

When making an authenticated request to the jsDelivr API, the API token obtained from your account is typically included in the HTTP Authorization header. While specific jsDelivr API endpoints and their exact authentication requirements should always be verified against the jsDelivr API documentation, a common pattern involves using a Bearer token. This method is widely adopted for its simplicity and effectiveness in securing API access, as detailed in RFC 6750 for OAuth 2.0 Bearer Token Usage.

For example, to purge the cache for a specific file or project using the jsDelivr API, you might send a POST request to a designated API endpoint. Below is a conceptual example using curl, demonstrating how to include your API token in the Authorization header:

curl -X POST \
  'https://api.jsdelivr.com/v1/purge' \
  -H 'Authorization: Bearer YOUR_JSDELIVR_API_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{ "files": ["/gh/user/repo@version/file.js", "/npm/package@version/dist/file.css"] }'

In this example:

• YOUR_JSDELIVR_API_TOKEN is a placeholder for the actual API token you generated.
• https://api.jsdelivr.com/v1/purge represents a hypothetical API endpoint for cache purging. The actual endpoint may vary.
• -H 'Authorization: Bearer YOUR_JSDELIVR_API_TOKEN' is the critical part for authentication, where Bearer indicates the type of token and your unique token follows.
• -H 'Content-Type: application/json' specifies that the request body is in JSON format.
• -d '{ "files": [...] }' contains the request payload, specifying the files or paths to be purged from the cache.

Always ensure that your API token is kept confidential and is transmitted over HTTPS to prevent interception. The specific fields in the request body (-d parameter) and the exact path of the API endpoint will depend on the particular jsDelivr API function you are trying to invoke. Consult the official jsDelivr API documentation for precise endpoint details and required parameters for each operation.

Security best practices

Securing your jsDelivr API access is crucial to prevent unauthorized administrative actions on your hosted open-source projects. Adhering to established security best practices for API keys and tokens can significantly mitigate risks. These practices align with general principles for API security, which are essential for maintaining the integrity and confidentiality of your interactions with any web service.

1. Keep API Tokens Confidential

• Treat as Passwords: Your jsDelivr API token should be treated with the same level of confidentiality as a password. Never embed it directly into client-side code (e.g., JavaScript in a browser), where it could be exposed to end-users.
• Avoid Public Repositories: Do not commit API tokens directly into version control systems, especially public or shared repositories. Use environment variables, secret management services, or configuration files that are excluded from version control (e.g., via .gitignore).
• Secure Storage: Store API tokens in secure locations, such as environment variables on your server, dedicated secret management tools (e.g., AWS Secrets Manager, Google Secret Manager), or encrypted configuration files.

2. Use HTTPS for All API Calls

• Encrypt Traffic: Always ensure that all API requests to jsDelivr are made over HTTPS. This encrypts the communication channel, protecting your API token and request data from eavesdropping and man-in-the-middle attacks. jsDelivr's API endpoints are inherently served over HTTPS, but it's important to ensure your client explicitly uses https://.

3. Implement Least Privilege

• Minimal Permissions: When generating API tokens, if jsDelivr offers the option to define token scopes or permissions, grant only the minimum necessary permissions required for the specific task the token will perform. For example, if a token only needs to purge cache, it should not have permissions to modify project settings, if such granular controls are available.

4. Rotate and Revoke Tokens Regularly

• Periodic Rotation: Regularly rotate your API tokens, especially for long-lived applications or automated scripts. This limits the window of opportunity for an attacker if a token is compromised.
• Immediate Revocation: If an API token is suspected of being compromised or is no longer needed, revoke it immediately through your jsDelivr account settings.

5. Monitor API Usage and Logs

• Audit Trails: If jsDelivr provides API usage logs or audit trails, regularly review them for any unusual or unauthorized activity. Anomalies could indicate a compromised token or malicious activity.

6. Secure Your Development Environment

• Local Security: Ensure that your local development environment where API tokens are used or stored is secure. Use strong passwords, keep software updated, and employ endpoint security measures.

7. Implement Rate Limiting and Error Handling

• Prevent Abuse: While primarily a server-side concern, be aware of jsDelivr's API rate limits. Implement proper error handling in your applications to gracefully manage rate limit responses, which can also help detect potential abuse of your API token.

By following these best practices, you can significantly enhance the security posture of your jsDelivr API integrations, protecting your projects and data from unauthorized access and manipulation. These principles are consistent with general API security guidelines recommended by industry experts and organizations, such as those outlined by Kong's API security best practices.