Securing Your Backend
3 steps to make your backend private. Only requests through Relay get in.
How it works: Relay adds a secret header to every request it forwards. Your backend checks that header. No header = rejected. That's it.
Step 1 — Copy your shared secret
Relay automatically generates a secure shared secret for your API. You can find it by going to Relay Dashboard → APIs → your API → Settings → Shared Secret.
Click the Copy button to save it to your clipboard.
Step 2 — Add one middleware to your backend
Pick your framework. Copy-paste this before your routes:
Express
Fastify
FastAPI
Go
Django
Copy// Add this BEFORE your routes
app.use((req, res, next) => {
if (req.headers['x-relay-signature'] !== process.env.RELAY_SHARED_SECRET) {
return res.status(403).json({ error: 'Forbidden' });
}
next();
});
Then add the secret to your backend's .env:
Copy# Paste the same secret from Relay Dashboard
RELAY_SHARED_SECRET=your-secret-here
Never commit your secret to git. Use
.env or a secrets manager.Step 3 — Test it
Copy# ✗ Direct → blocked
curl https://api.yourproject.com/users
→ { "error": "Forbidden" }
# ✓ Through Relay → works
curl https://gateway.relay.com/your-slug/users \
-H "X-Api-Key: relay_sk_..."
→ { "users": [...] }
Direct requests get 403 Forbidden. Requests through Relay with a valid API key go through. Done ✓