degallery-auth-and-private-media

---
name: degallery-auth-and-private-media
description: Choose safe DeGallery credentials for browser and server code, and authorize private gallery or asset delivery. Use when handling API keys, publishable keys, read tokens, or delivery capabilities.
---

# Credentials and private media

Keep authentication and authorization at the correct runtime boundary. A credential's name does not grant permission to expose it; follow the limits of its scope and the current DeGallery API contract.

## Credential placement

- **Private API key:** trusted server or worker only. Store it in a managed secret store. Never put it in browser bundles, source examples, URLs, or `NEXT_PUBLIC_*` variables.
- **Publishable key:** may be used in browser code for its restricted public-content scope. It cannot read private resources or analytics.
- **Read token:** short-lived and scoped for a browser read flow where supported. Obtain it through an authorized server path and do not log it.
- **Delivery signing secret:** trusted server only. Never return it to a browser or use it to sign client-selected resources without authorization checks.

When unsure which credential is appropriate, keep the operation server-side and consult the current DeGallery auth documentation.

## Private gallery and asset delivery

1. Authenticate the end user and resolve their organization/environment scope on the server.
2. Check that the user is allowed to access the requested gallery or asset. Do not trust a client-supplied organization ID, asset ID, visibility value, or preset as authorization.
3. Issue or retrieve only the scoped, short-lived read/delivery capability supported by the integration path.
4. Return only the capability or data the browser needs. Never return API or signing secrets.
5. Avoid logging tokens, signed URLs, or private media identifiers. Refresh expiring private data through the trusted server path.

The Node package's `createDeliveryToken()` signs Worker-compatible claims using HMAC-SHA256 and enforces a maximum lifetime of 15 minutes. It does not decide whether the caller is authorized: validate ownership, visibility, resource, preset, and expiry before calling it. Keep token issuance in Node/server code.

## React and browser guidance

`@degallery/react` is client-side UI. Do not pass a private API key to `GalleryProvider`. For private galleries, use the supported scoped short-lived read-token flow or a server-resolved payload. Do not assume public gallery access implies permission for private assets.

For package-specific setup, see the [private gallery authorization guide](https://docs.degallery.dev/docs/how-to/authorize-a-private-gallery), [JavaScript client guide](https://docs.degallery.dev/docs/javascript/get-started), and [React provider guide](https://docs.degallery.dev/docs/react/provider). Use `degallery-javascript` for SDK or Node setup.