Run allowlisted LogoRouter presets through a hardened Next.js bridge: selectable dashboard keys attach exclusively on the server, guest paste paths stay short-lived over TLS, and only JSON / image payloads from known routes return to your browser tab.
How keys attach: Signed-in builders pick any eligible dashboard secret; Clerk session cookies gate the bridging route. Unsigned visitors can optionally paste short-lived guest keys that never persist in Local Storage—prefer disposable keys during pair sessions.
Rate limits: Playground bridging enforces roughly 25 requests / minute / IP. Bursting resets automatically; abusive IPs receive plain JSON errors.
Preset catalogue
Every row below maps 1:1 to the bridging allowlist. Anything outside this table must be exercised with curl / SDK clients.
| Preset | Upstream | Domain input | Auth expectation |
|---|---|---|---|
| Health | GET /health | Hidden | None |
| Logo (image) | GET /api/{domain} | Required | Bearer optional · publishable improves quotas for raster GET surfaces |
| Brand colors | GET /api/colors/{domain} | Required | Dashboard secret enforced (guest paste allowed but discouraged) |
| Company intelligence | GET /api/intelligence/{domain} | Required | Requires secret key — publishable variants always fail upstream |
GET /health — status, version, no API key.
Carry on in the written docs