Developer Documentation

Every request through the Backport gateway must include a valid API key in the X-API-Key header. Keys are automatically created when you sign up and can be managed from the Dashboard.

How to get your API key

1. 1.Sign up at backport-io.vercel.app/auth/signup
2. 2.Verify your email (a 6-digit OTP is sent to your inbox)
3. 3.After verification, your API key is returned automatically. You can also find it in Dashboard → API Keys.

Using your API key

# GET request through the gateway
curl -X GET https://backport-io.onrender.com/proxy/users \
  -H "X-API-Key: bk_your_key_here"

# POST request with idempotency (e.g. payments)
curl -X POST https://backport-io.onrender.com/proxy/checkout \
  -H "X-API-Key: bk_your_key_here" \
  -H "Idempotency-Key: txn_unique_12345" \
  -H "Content-Type: application/json" \
  -d '{"amount": 5000}'

API Key limits by plan

All traffic flows through a single proxy endpoint. The gateway authenticates your request, applies WAF rules, checks rate limits, serves from cache if available, and forwards to your configured backend.

Request Headers

Response Codes

Backport adds the following headers to every proxied response, so you can monitor gateway behavior in your application.

Backport includes a Web Application Firewall (WAF) with 17 pre-compiled regex patterns that inspect every request at the gateway level before it reaches your backend. WAF can be toggled on/off from your dashboard settings. By default, WAF is OFF.Enable it when you're ready.

Important: The WAF uses regex-based pattern matching. While it covers common attack vectors, always validate and sanitize inputs at your application layer as defense-in-depth. WAF is a first line of defense, not a replacement for secure coding practices.

Backport applies a sliding-window rate limiter to protect your backend from traffic spikes and abuse. Rate limiting is enabled by default. When the limit is exceeded, requests get an HTTP 429 response and your backend is never hit.

Rate limits by plan

Heavy GET endpoints like analytics, reports, or lists often hit your database on every request. If you enable caching in your dashboard settings, Backport intercepts GET responses with status 200 and stores them in an in-memory LRU cache. By default, caching is OFF. Enable it from settings.

• Only GET requests with 200 status are cached
• Default TTL: 5 minutes — expired entries are evicted automatically
• Maximum 1,000 cached entries — oldest entries are evicted when the limit is reached
• Cached responses return with X-Backport-Cache: HIT header
• Subsequent cache hits are served in under 2ms without touching your backend

Duplicate POST requests are a common problem — especially for payments, orders, and form submissions. When a user loses connection and retries, your backend might process the same action twice. Backport solves this by storing the first response and replaying it for duplicate keys. Idempotency is enabled by default.

# First request — processed normally and cached
curl -X POST https://backport-io.onrender.com/proxy/checkout \
  -H "X-API-Key: bk_your_key" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: txn_88910" \
  -d '{"amount": 5000, "currency": "INR"}'

# Retry with same Idempotency-Key — returns original response
# without hitting your backend
curl -X POST https://backport-io.onrender.com/proxy/checkout \
  -H "X-API-Key: bk_your_key" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: txn_88910" \
  -d '{"amount": 5000, "currency": "INR"}

• Works with POST, PUT, and PATCH methods
• Triggered by the Idempotency-Key request header
• Maximum 5,000 stored idempotency results per server
• Duplicate requests return with X-Backport-Idempotent: REPLAY header

The dashboard uses JWT-based authentication. After login, a token is returned that you can use to access your account data programmatically. All dashboard endpoints require an Authorization: Bearer <token> header.

# Login to get JWT token
curl -X POST https://backport-io.onrender.com/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "your_password"}'

# Use the token to access dashboard API
curl -X GET https://backport-io.onrender.com/api/user/me \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."