Algolia

Overview

Use Algolia credentials to make authenticated API calls through Alter Vault without exposing API keys in code.

Property	Value
Provider ID	algolia
Category	Search
Credential Type	API Key

Step 1: Get Credentials

Log in to the Algolia Dashboard

Log in to the Algolia Dashboard at dashboard.algolia.com.

Go to Settings → API Keys

Go to Settings → API Keys at dashboard.algolia.com/account/api-keys/all.

Copy the Admin API Key

Copy the Admin API Key (or create a new one with specific permissions).

Copy the Application ID

Copy the Application ID for the Application ID field.

Warning

Never share credentials publicly. Store them securely and only enter them in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Algolia

Go to Managed Secrets > Add Provider > Algolia.

Enter credentials

Paste your Admin API Key into the credential field.

Enter the Application ID

Paste your Application ID (e.g. B1G2GM9NG0) into the Application ID field. Alter injects it as the X-Algolia-Application-ID header and derives this credential’s allowed hosts from it — the application’s write, DSN, and fallback search hosts (APPID.algolia.net, APPID-dsn.algolia.net, APPID-1.algolianet.com, APPID-2.algolianet.com, APPID-3.algolianet.com) — so proxied calls can only ever reach your application’s Search API. Algolia’s other APIs (such as Insights and Analytics) live on separate fixed hosts and are not covered by this template. The allowlist cannot be widened or edited separately; rotate the credential with a new Application ID to retarget it.

Save

Click Save. You’ll receive a grant_id to use with the SDK.

Using in Code

response = await alter_app.request(
    HttpMethod.POST,
    "https://YOUR_APP_ID-dsn.algolia.net/1/indexes/YOUR_INDEX/query",
    grant_id="YOUR_GRANT_ID",
    json={"query": "search terms"},
)

For deleteBy, parameter conditions can target indexName. Current filter and geo-selector fields are accepted, but they are not projected as scalar policy parameters: filters contain case-sensitive expressions, and geo selectors can override each other. Selector conditions, including obsolete params conditions, fail closed. The obsolete params request field is rejected. Use operation, family, or index-level controls for this operation.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
search	read	POST	/1/indexes/*/queries
searchSingleIndex	read	POST	/1/indexes/{indexName}/query
searchForFacetValues	read	POST	/1/indexes/{indexName}/facets/{facetName}/query
browse	read	POST	/1/indexes/{indexName}/browse
getObject	read	GET	/1/indexes/{indexName}/{objectID}
getObjects	read	POST	/1/indexes/*/objects
saveObject	write	POST	/1/indexes/{indexName}
addOrUpdateObject	write	PUT	/1/indexes/{indexName}/{objectID}
partialUpdateObject	write	POST	/1/indexes/{indexName}/{objectID}/partial
batch	delete, write	POST	/1/indexes/{indexName}/batch
multipleBatch	delete, write	POST	/1/indexes/*/batch
deleteObject	delete	DELETE	/1/indexes/{indexName}/{objectID}
deleteBy	delete	POST	/1/indexes/{indexName}/deleteByQuery
clearObjects	delete	POST	/1/indexes/{indexName}/clear
deleteIndex	delete	DELETE	/1/indexes/{indexName}
operationIndex	delete, write	POST	/1/indexes/{indexName}/operation
listIndices	read	GET	/1/indexes
getSettings	read	GET	/1/indexes/{indexName}/settings
setSettings	admin	PUT	/1/indexes/{indexName}/settings
saveRule	write	PUT	/1/indexes/{indexName}/rules/{objectID}
searchRules	read	POST	/1/indexes/{indexName}/rules/search
saveSynonym	write	PUT	/1/indexes/{indexName}/synonyms/{objectID}
searchSynonyms	read	POST	/1/indexes/{indexName}/synonyms/search
getTask	read	GET	/1/indexes/{indexName}/task/{taskID}
getLogs	read	GET	/1/logs
addApiKey	admin	POST	/1/keys
listApiKeys	read	GET	/1/keys