Server overview

The React SDK never sends your API key to the browser. Your server mints a short-lived embed token by calling app.aiql.io/api/embed/tokens, then the client fetches that token from your own route (default /api/aiql). @aiql.io/react/server is a React-free entry point safe to import in Next.js route handlers, Express, or any Node runtime.

Security model

Store AIQL_API_KEY and AIQL_WORKSPACE_ID as server env vars.
Expose a same-origin endpoint (for example GET /api/aiql).
The handler calls AiQL with Authorization: Bearer <API_KEY> and returns { token, expiresAt, expiresIn } to the browser.
useToken reads that response and passes the JWT into AiqlProvider.

Environment variables

Variable	Required	Description
`AIQL_API_KEY`	Yes (or pass `apiKey`)	AiQL API key that owns workspace membership.
`AIQL_WORKSPACE_ID`	Yes (or pass `workspaceId`)	Workspace the embed token is scoped to.

Import

import {
  createNextHandler,
  createExpressHandler,
  handleTokenRequest,
  mintWorkspaceToken,
} from "@aiql.io/react/server";

Next steps

See Handlers for one-line Next.js and Express setup, plus the core mintWorkspaceToken API.

React Components

React Hooks

React Server

Security model

Environment variables

Import

Next steps

​Security model

​Environment variables

​Import

​Next steps

Security model

Environment variables

Import

Next steps