> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aiql.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Server overview

> Mint workspace-scoped embed tokens on your backend with @aiql.io/react/server.

The React SDK never sends your API key to the browser. Your server mints a short-lived embed token by calling `app.aiql.io/api/embed/tokens`, then the client fetches that token from your own route (default `/api/aiql`).

`@aiql.io/react/server` is a React-free entry point safe to import in Next.js route handlers, Express, or any Node runtime.

## Security model

1. Store `AIQL_API_KEY` and `AIQL_WORKSPACE_ID` as server env vars.
2. Expose a same-origin endpoint (for example `GET /api/aiql`).
3. The handler calls AiQL with `Authorization: Bearer <API_KEY>` and returns `{ token, expiresAt, expiresIn }` to the browser.
4. `useToken` reads that response and passes the JWT into `AiqlProvider`.

## Environment variables

| Variable            | Required                    | Description                                  |
| ------------------- | --------------------------- | -------------------------------------------- |
| `AIQL_API_KEY`      | Yes (or pass `apiKey`)      | AiQL API key that owns workspace membership. |
| `AIQL_WORKSPACE_ID` | Yes (or pass `workspaceId`) | Workspace the embed token is scoped to.      |

## Import

```ts theme={null}
import {
  createNextHandler,
  createExpressHandler,
  handleTokenRequest,
  mintWorkspaceToken,
} from "@aiql.io/react/server";
```

## Next steps

See [Handlers](/sdks/react/server/handlers) for one-line Next.js and Express setup, plus the core `mintWorkspaceToken` API.