How-to
Authorize a private gallery
Keep private gallery authorization on the server while rendering an interactive client UI.
Private access should be decided by your server using the authenticated user, organization, and gallery ownership rules. Do not let a client-provided gallery ID decide authorization by itself.
Server boundary
const canRead = await authorization.canReadGallery({
userId: session.user.id,
galleryId,
});
if (!canRead) throw new Error('Forbidden');
const gallery = await client.getGallery(galleryId);Return the gallery payload or issue a short-lived read capability only after the server check. The React component should receive authorized data; it should not hold a service API key.
Recommended flow
sequenceDiagram
participant Browser
participant App as Your server
participant API as DeGallery API
Browser->>App: Request gallery page
App->>App: Authenticate user and check ownership
App->>API: Read gallery with server credential
API-->>App: Authorized metadata and delivery URLs
App-->>Browser: Renderable gallery payload