On this page
Choose Function Access, API Keys, and Web Origins
Function access determines who may call a MiniUp Function. Allowed methods determine which HTTP actions it accepts. Allowed Web Origins controls browser access and is not a replacement for authentication.
Compare Function access modes
| Mode | Best for | Browser secret needed |
|---|---|---|
| Public | Open APIs | No |
| API Key | Trusted external/server calls | Yes — caller needs a key; keep it out of browsers |
| Site Members | Authenticated MiniUp apps | No |
| x402 Paid | Optional payment per successful request | No Function key; an x402-compatible client satisfies payment |
For API Key mode, the caller needs a secret, but it belongs in trusted server code. Do not embed the Function API key in browser JavaScript. Site Members mode avoids this browser secret by using the linked Site’s authenticated membership.
Configure Public or API Key access
- Open Functions → your Function → API.
- Choose Public or API Key under Access and select Save access.
- For API Key mode, select Generate key and copy the revealed value immediately. MiniUp shows the full key only once.
- Choose allowed methods: GET, POST, PUT, PATCH, or DELETE. Save API settings.
- Call the copied endpoint with a method your handler implements.
curl 'https://functions.miniup.app/my-api/health' -H 'x-miniup-api-key: YOUR_API_KEY'Replace the example endpoint with the endpoint shown in your Function editor. The public Function API accepts x-miniup-api-key for API-key authentication.
Rotate a Function API key
Select Rotate key, review the confirmation, and securely copy the replacement. There is one active key per Function. The old key stops working when the replacement becomes active; update all trusted callers and test them. Key and access updates are separate from editing and publishing a new code draft.
Configure Allowed Web Origins
For Public and API Key Functions, enter exact origins in Allowed Web Origins (CORS), separated by semicolons:
https://my-site.miniup.app; https://example.comUse a scheme and hostname, with a port if needed. Do not include a path, trailing slash, or wildcard. Leaving the list empty allows all websites to make browser requests. Non-browser callers are not restricted by this browser setting; use API Key access to restrict callers.
Configure Site Members access
Choose Site Members, select the Linked MiniUp Site you own, and save access. Alternatively create the Function directly from that Site’s Functions tab. Same-origin calls from the linked Site do not require Web Origin configuration or a browser Function key.
Configure optional x402 payments
Under x402 Monetization, select Enable x402 payments to add a payment fallback to any access setting. Valid API keys and verified Site Members bypass payment. External callers pay positive route prices; $0 routes require no payment proof or settlement. Enter a decimal USD price and payout wallet, choose directory listing and external discovery independently, and save access. Follow the paid Function guide for payment behavior and preview. Public, API Key, and Site Members Functions do not need payment configuration.