The headers the REST API understands, and which key to send.
| Header | Purpose |
|---|---|
apikey | Your project key. Required on every request (or the apikey query parameter). |
Authorization: Bearer <token> | A signed-in user's access token, to run the request as that user. |
Content-Type: application/json | For requests with a JSON body. |
Prefer: return=representation | Return the inserted or changed rows. |
Prefer: count=exact | Return the total row count in Content-Range (also planned, estimated). |
Prefer: resolution=merge-duplicates | Upsert: update rows that conflict instead of failing. |
Range: 0-9 | Request a range of rows (the SDK uses .range()). |
Accept: text/csv | Return CSV instead of JSON (.csv()). |
Accept-Profile / Content-Profile | Choose another exposed schema (stitchdb.schema('name')). |
X-Stitch-Read: primary | Answer this read from the primary database, not a read replica. |
Accept-Encoding: br, gzip | Compress the answer. JSON, CSV, XML and plain-text answers over 1 KB from the REST and GraphQL API come back with brotli (br) or gzip; browsers and most HTTP clients send this header for you. Auth answers are never compressed. |
Responses can carry X-StitchDB-Box, the server that answered. Compressed answers carry Vary: Accept-Encoding, and egress counts the compressed bytes.
#Which key?
Use the anon key in browsers and mobile apps; requests are limited by Row Level Security. Use the service_role key only on servers you control: it bypasses Row Level Security.