Server / Admin
Use the secret key (cb_sk_…) from trusted servers only. It bypasses rules and unlocks these endpoints. In the JS SDK on Node: ClickBase.init({ projectId, secretKey }) then app.admin.*.
| Endpoint | Purpose |
|---|---|
| GET /admin/users?q=&limit=&offset= | list/search users |
| POST /admin/users | create user {email, password?, displayName?, emailVerified?, claims?} |
| GET /admin/users/{uid|email} | get user |
| PATCH /admin/users/{uid} | update {displayName, password, emailVerified, disabled, claims, meta} |
| DELETE /admin/users/{uid} | delete user + tokens |
| POST /admin/token | {uid} or {email} → tokens for that user (custom sign-in) |
| POST /admin/verify-token | {token} → {claims} |
| GET /admin/collections | collections with counts |
| GET /admin/stats | users, docs, files, usage today |
| DELETE /admin/drop?collection=x | delete a whole collection |
Verifying tokens yourself
Tokens are HS256 JWTs signed with your project's JWT secret (Console → Settings → Show). Any JWT library works: verify signature, exp, and aud === projectId.
// Node
const jwt = require("jsonwebtoken");
const claims = jwt.verify(token, PROJECT_JWT_SECRET, { audience: "my-shop" }); // claims.sub = uidWas this page helpful? Tell us. · Download SDK