Skip to content

A layer in front of your API, the key on the server.

Your apps call this layer's /api routes. The routes forward to your real API with the key attached on the server, so it never reaches the browser.

Open on GitHubMIT licence · free to use

Use it when

You already have an API or a third-party service and need a secure layer in front of it — with a website included.

Building the API from scratch? template-backend instead →

What's included

Done from the start.

  • A proxy for everything

    A catch-all route forwarding GET, POST, PUT, PATCH and DELETE, with query and JSON.

  • Typed client

    A server-side client with a Bearer key, a 30-second timeout and clear errors.

  • CORS and tracing

    Allowed origins from a list, and an x-request-id on every response.

  • Webhooks and health

    A webhook receiver and a health check.

  • Security headers

    HSTS, X-Frame-Options, Referrer-Policy and Permissions-Policy.

  • Design system

    Tailwind CSS 4 with dark mode and components for a landing page.

Get started

pnpm install
cp .env.example .env.local
pnpm dev          # http://localhost:3009

Structure

app/api/proxy/[...path]/   forwards every method to API_BASE_URL
app/api/webhooks/          webhook receiver
app/api/health/            health check
lib/api-client.ts          typed server-side client
middleware.ts              CORS + x-request-id
components/                design system and landing page

Environment variables

  • API_BASE_URL
  • API_KEY
  • ALLOWED_ORIGINS
  • NEXT_PUBLIC_APP_URL

API_KEY is optional and sent as a Bearer token to your API.

Good to know

  • Webhook signature verification is a TODO — add it for your provider before going live.
  • The Dockerfile copies a public/ folder the repo doesn't have yet. Create it before building the image.

Built with

  • Next.js 15
  • React 19
  • TypeScript
  • Tailwind CSS 4
  • next-themes
  • Docker

Let's build
the next thing.

You talk to me, not a salesperson. The first call is free.

— Kenny

psst, it takes 15 min

Write, and I reply the same working day.