Authentication
The Neon API declares 3 security schemes. The client sends each credential only on the operations whose security requirement accepts that scheme, so one configured client covers every operation.
| Scheme | ClientAuth field | Sent as |
|---|---|---|
| BearerAuth | bearerAuth | Authorization: Bearer … |
| CookieAuth | cookieAuth | zenith in cookie |
| TokenCookieAuth | tokenCookieAuth | keycloak_token in cookie |
Configuring the client
Credentials go on the client once, when it is created, and the SDK attaches the right one to each request.
ts
const client = new Neon({
// Optional: replaces the default server and any server an operation declares.
baseUrl: "https://console.neon.tech/api/v2",
auth: { bearerAuth: process.env.API_TOKEN! },
});Keep credentials out of source control
Read them from the environment or a secrets manager, as the quickstart does. A key committed to a repository should be treated as leaked and rotated.