Client Config

Retrieve client-safe configuration values for embedding in browser-side applications.

The Client Config endpoint returns configuration values that are safe to embed in browser-side code. This is useful for retrieving platform-managed API keys (such as mapping service keys) without exposing backend secrets.

Values returned by this endpoint are restricted by HTTP referrer or similar origin controls at the provider level. They are not general-purpose secrets.

Get Client Configuration

Returns client-safe configuration for the authenticated workspace. Requires workspace-level authentication. Rate-limited.

Get client configuration

get

Return client-safe configuration for the authenticated workspace.

Authorizations

AuthorizationstringRequired

API key issued via POST /v1/{workspace_id}/api-keys. Pass the returned api_key value as a Bearer token.

Path parameters

workspace_idstring · uuidRequired

Responses

200

Successful Response

application/json

Client-safe configuration values.

Values returned here are safe to embed in browser-side code. API keys are restricted by HTTP referrer or similar origin controls at the provider level.

google_maps_api_keystring · max: 512 · nullableOptional

get/v1/{workspace_id}/config/client

GET /v1/{workspace_id}/config/client HTTP/1.1
Host: platform.api-us.concurrence.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

200

Successful Response

{
  "google_maps_api_key": "text"
}

Example Request

curl -X GET "https://platform.api-us.concurrence.com/v1/{workspace_id}/config/client" \
  -H "Authorization: Bearer <token>"

Example Response

{
  "google_maps_api_key": "AIza..."
}

When no key is configured:

{
  "google_maps_api_key": null
}

Notes

• The endpoint requires workspace authentication but returns platform-global configuration. The workspace gate ensures only authenticated callers can retrieve keys.

• Fields are null when the corresponding value is not configured or is set to a placeholder.

• Additional client-safe fields may be added to the response in future releases without a version bump. Clients should ignore unknown fields.