Use the database API

CloudAuro offers two separate APIs: Website accounts handles visitor signup/login securely, while the managed-data API reads or changes rows in your project's tables. Do not create a normal password column or put passwords into a managed table. A website login does not automatically authorize table access.

1. Create and connect your database#

Open your project, select Database, and choose Website accounts, Contact messages, Newsletter subscribers, or Empty database. Your plan's database limit is shared across projects: Basic 0, Pro 1, Business 5. Existing databases have an Enable signup & login button for visitor accounts. Publish your website before testing website-origin endpoints.

2. Choose the API you need#

For visitor login, use the Website accounts SDK on your own published website: load /__cloudauro/auth.js. It manages host-only HttpOnly cookies, so you do not need an API key. See Add website signup and login and Build your own login page below.

For ordinary table data, create a table using the visual field builder or a preset. Open Manage table rows and API access, load/select your table, and create a scoped token. Copy Database ID and Selected table ID from the labeled fields in Manage table rows and API access (load and select a table first). The generated token is shown separately; its id is a credential ID, not the database ID. The management API GET /api/databases returns database IDs; GET /api/databases/{database_id}/tables returns table IDs. Those management calls require a CloudAuro customer session; they do not belong in visitor JavaScript.

3. Read public table data from your hosted website#

Replace the database ID, table ID, API origin, and token below with your actual values. API_ORIGIN must be the canonical CloudAuro management address serving /api/data (for local development, use http://localhost:5000). This API is on the management origin; Website accounts is on your website origin. CORS permits the linked website origin, including a currently verified custom domain. A 30-day read-only token is public to anyone viewing your website, so only use it for information intended to be public.

const API_ORIGIN = "https://www.cloudauro.com";
const databaseId = "YOUR_DATABASE_UUID";
const tableId = "YOUR_TABLE_UUID";
const publicReadToken = "YOUR_READ_ONLY_TOKEN";
const url = `${API_ORIGIN}/api/data/${databaseId}/tables/${tableId}/rows?page=1&limit=25`;
const response = await fetch(url, {
  credentials: "omit",
  headers: { Authorization: `Bearer ${publicReadToken}` }
});
const result = await response.json();
if (!response.ok) throw new Error(result.error?.message || "Unable to load rows");
for (const row of result.data.items) {
  console.log(row.id, row.values);
}
// result.data: { items, page, limit, hasMore }

Page numbers start at 1; limit defaults to 25 and has a maximum of 100. Request the next page while hasMore is true. The response format is {data, error}; an unsuccessful request has error.code and error.message. When showing returned text in HTML, use textContent instead of innerHTML.

4. Write data only from a trusted service#

Never put a write/delete token in public HTML or JavaScript. Use a trusted backend you control, with the token stored in its environment. CloudAuro hosts static files and does not execute customer Python/Node code; a trusted backend is a separate service you operate. The following shell example uses an environment variable, not a hardcoded credential:

curl -X POST "https://www.cloudauro.com/api/data/DATABASE_ID/tables/TABLE_ID/rows" \
  -H "Authorization: Bearer $CLOUDAURO_WRITE_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"values":{"name":"Example","email":"[email protected]","message":"Hello"}}'

For a contacts preset, values must contain exactly name, email, and message, with text values. Other tables must match their declared fields and types: text, integer, number, or boolean. POST /rows inserts a row; PATCH /rows/{row_id} replaces all declared field values; DELETE /rows/{row_id} removes a row. Bearer permissions must include the corresponding operation. A read-and-write token does not include delete permission.

Troubleshooting#

401 usually means a missing bearer token or missing website session. 403 can mean an expired token, wrong permission, wrong website origin, or an invalid current password. 402 means the hosting entitlement is unavailable. 409 can indicate a quota, duplicate account, or pending edit. 429 means you should wait before retrying. Keep write credentials private; visitor login cookies do not replace database bearer authorization or provide private per-user row access. Tables currently allow 20 fields, 10,000 rows each, and 64 KiB per row. Tokens expire after 30 days; generate replacements in the dashboard when needed.