Skip to main content
By default, MossClient authenticates using your projectId and projectKey:
This works well for server-side code where secrets stay on the backend. For browser / frontend use, you should never embed your projectKey in client-side code. Instead, implement a custom IAuthenticator that fetches a short-lived token from your own backend.

The IAuthenticator interface

The SDK exports IAuthenticator and AuthToken types from @moss-dev/moss. Their shapes are shown below for reference - you don’t need to redefine them in your code.
Both methods must be implemented. The SDK calls getAuthHeader() before every request.

1. Your backend - expose a token endpoint

Your backend holds the projectKey securely and uses the SDK to fetch a token, returning it directly to the frontend.

2. Your frontend - implement IAuthenticator

Since your backend forwards the Moss auth response unchanged, response.json() already matches the AuthToken shape - no manual mapping needed.

Token caching

The SDK automatically wraps your authenticator with an internal caching layer. Tokens are cached for expiresIn - 60 seconds, so your backend is only called when the token is about to expire - not on every SDK request. No extra setup is needed.
Make sure your backend returns the correct expiresIn value so the cache TTL is accurate.

Summary

Rule of thumb: your projectKey must never appear in browser-facing code. The custom authenticator pattern ensures it stays on your server while the frontend still gets authenticated access to Moss.