API Client Configuration

The createApiClient function creates a server-side API client that works seamlessly with the auth proxy. It handles token management, request sanitization, and proper error formatting.

Basic Setup#

Using the API Client#

In API Routes#

Available Methods#

Request Options#

All methods accept an optional options parameter:

Available Options

| Option | Type | Description | |--------|------|-------------| | headers | object | Custom headers for the request | | queryParams | object | Query parameters to append to URL | | isFormData | boolean | Set true when sending FormData | | skipSanitize | boolean | Skip all response sanitization for this request | | skipSanitizeFields | string[] | Skip sanitization for specific fields only |

Per-Request Sanitization Control

Sometimes you need to receive raw HTML from the backend (e.g., CMS content, rich text editors):

Configuration Options#

apiBaseUrl#

Required - Backend API base URL.

cookies#

Required - Must match the cookie names in your auth proxy.

sanitization#

XSS protection for response data.

Default Sanitization

By default, all string values in responses are sanitized:

i18n#

Automatically append locale to API requests. Works with the x-locale header set by the auth proxy.

When enabled, the API client:

1. Reads the x-locale header (set by auth proxy middleware)
2. Validates it against the locales array
3. Appends ?lang={locale} to all requests

See the i18n documentation for full setup guide.

methodSpoofing#

For backends (like Laravel) that don't support PUT/PATCH/DELETE methods natively.

When enabled:

errorMessages#

Customize error messages.

timeout#

Request timeout in milliseconds.

defaultHeaders#

Headers to include in every request.

responseFormat#

Expected response format.

Advanced Usage#

Custom Headers per Request#

Query Parameters#

File Uploads#

Raw Response#

With Refreshed Token#

The API client automatically uses refreshed tokens from the proxy:

Full Example#

Response Format#

All API client methods return a Response object:

Error Handling#

Token Priority#

The API client uses tokens in this order:

1. x-refreshed-token header - If proxy just refreshed the token
2. User token cookie - For authenticated requests
3. Guest token cookie - For guest requests

This ensures seamless token refresh without race conditions.