API Integration Examples

Learn how to use Conduit Link with popular APIs. Simply override the base URL in your favorite SDK or API client to route requests through your secure proxy.

Security Best Practices

  • Never expose your Conduit Access Token in client-side code. Use environment variables or secure server-side storage.
  • Configure CORS settings in your Conduit Link to only allow requests from your domains.
  • Set appropriate rate limits to prevent abuse and control costs.
  • Use path restrictions to limit which API endpoints can be accessed through your proxy. Configure allowed_paths in your Conduit Link settings to prevent unauthorized access to sensitive endpoints. For example, allow only /v1/chat/completions for ChatGPT instead of exposing all OpenAI endpoints.
  • Enable JWT verification for additional authentication when needed.

🛡️ Path Restrictions: Your First Line of Defense

The allowed_paths setting is crucial for securing your API proxy. It acts as a whitelist, ensuring only specific endpoints can be accessed through your Conduit Link.

❌ Without Path Restrictions

  • • All API endpoints are accessible
  • • Risk of exposing sensitive operations
  • • Potential for unexpected API usage
  • • Higher security vulnerability

✅ With Path Restrictions

  • • Only whitelisted endpoints work
  • • Prevents access to admin/billing APIs
  • • Reduces attack surface
  • • Better cost control and security

Example configuration in your Conduit Link:

{
  "allowed_paths": [
    "/v1/chat/completions",     // ChatGPT conversations only
    "/v1/embeddings",           // Text embeddings
    "/v1/models"                // List available models
  ]
  // Blocked by default: /v1/files, /v1/fine-tunes, /v1/organizations, etc.
}

🔐 JWT Verification: User-Level Security

JWT (JSON Web Token) verification adds an extra layer of security by authenticating individual users. This enables user-specific rate limiting, usage tracking, and access control at the user level.

Why Use JWT Verification?

  • User-specific rate limits: Prevent individual users from abusing your API quota
  • Usage tracking: Monitor API usage per user for billing or analytics
  • Access control: Restrict certain endpoints to specific user roles or tiers
  • Audit trail: Know exactly which user made which API request

Implementation example:

// 1. Configure JWT verification in your Conduit Link settings
{
  "jwt_verification": {
    "enabled": true,
    "secret": "your-jwt-secret-key",
    "algorithm": "HS256"
  }
}

// 2. Generate a JWT for each user in your backend
import jwt from 'jsonwebtoken';

const userToken = jwt.sign(
  { 
    userId: user.id,
    email: user.email,
    role: user.role,
    // Optional: Add expiration
    exp: Math.floor(Date.now() / 1000) + (60 * 60) // 1 hour
  },
  process.env.JWT_SECRET
);

// 3. Include the JWT in API requests
const response = await fetch('https://proxy.conduit.link/YOUR_LINK_ID/v1/chat/completions', {
  method: 'POST',
  headers: {
    'X-Access-Token': 'YOUR_CONDUIT_ACCESS_TOKEN',
    'Authorization': `Bearer ${userToken}`, // User's JWT
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    model: 'gpt-3.5-turbo',
    messages: [{ role: 'user', content: 'Hello!' }],
  }),
});

⚠️ Important: Never generate JWTs on the client side. Always create them in your secure backend to prevent token forgery and maintain control over user authentication.

🚀 Quick Start

  1. 1. Create a Conduit Link in your dashboard for your target API
  2. 2. Copy your Link ID and Access Token
  3. 3. Replace the API base URL with your Conduit Link URL
  4. 4. Use your Access Token instead of the actual API key
  5. 5. (Optional) Enable JWT verification for user-level security
🤖

OpenAI

Use ChatGPT and other OpenAI models without exposing your API key

Configuration

Original API URL: https://api.openai.com/v1
Conduit Link URL: https://proxy.conduit.link/YOUR_LINK_ID/v1

🔒 Recommended Path Restrictions

Security Tip: Restrict access to only the endpoints you need. For example, if you're only using ChatGPT, limit to /v1/chat/completions.

Add these to your allowed_paths setting:

[
  "/v1/chat/completions",
  "/v1/completions",
  "/v1/embeddings",
  "/v1/images/generations",
  "/v1/audio/transcriptions",
  "/v1/models"
]

Using OpenAI SDK with Custom Base URL

import OpenAI from 'openai';

// Instead of exposing your API key in the client
const openai = new OpenAI({
  apiKey: 'dummy-key', // Real key is stored in Conduit Link
  baseURL: 'https://proxy.conduit.link/YOUR_LINK_ID/v1',
  defaultHeaders: {
    'X-Access-Token': 'YOUR_CONDUIT_ACCESS_TOKEN',
    // Optional: Add JWT for user-specific rate limiting
    'Authorization': 'Bearer YOUR_USER_JWT_TOKEN'
  },
  dangerouslyAllowBrowser: true // Required for client-side usage
});

// Use the SDK normally
const completion = await openai.chat.completions.create({
  model: "gpt-3.5-turbo",
  messages: [
    { role: "user", content: "Hello, how are you?" }
  ],
});

console.log(completion.choices[0].message);

Direct API Call with Fetch

// Direct API call without SDK
const response = await fetch('https://proxy.conduit.link/YOUR_LINK_ID/v1/chat/completions', {
  method: 'POST',
  headers: {
    'X-Access-Token': 'YOUR_CONDUIT_ACCESS_TOKEN',
    'Content-Type': 'application/json',
    // Optional: Add JWT for user-specific rate limiting
    'Authorization': 'Bearer YOUR_USER_JWT_TOKEN'
  },
  body: JSON.stringify({
    model: 'gpt-3.5-turbo',
    messages: [
      { role: 'user', content: 'Explain quantum computing in simple terms' }
    ],
    temperature: 0.7,
  }),
});

const data = await response.json();
console.log(data.choices[0].message.content);

Streaming Responses

// Handle streaming responses
const response = await fetch('https://proxy.conduit.link/YOUR_LINK_ID/v1/chat/completions', {
  method: 'POST',
  headers: {
    'X-Access-Token': 'YOUR_CONDUIT_ACCESS_TOKEN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    model: 'gpt-3.5-turbo',
    messages: [{ role: 'user', content: 'Write a story' }],
    stream: true,
  }),
});

const reader = response.body.getReader();
const decoder = new TextDecoder();

while (true) {
  const { done, value } = await reader.read();
  if (done) break;
  
  const chunk = decoder.decode(value);
  console.log(chunk); // Process each chunk
}
💳

Stripe

Process payments securely without exposing your Stripe secret key

Configuration

Original API URL: https://api.stripe.com/v1
Conduit Link URL: https://proxy.conduit.link/YOUR_LINK_ID/v1

🔒 Recommended Path Restrictions

Security Tip: Limit access to payment-related endpoints only. Avoid exposing sensitive endpoints like /v1/accounts or /v1/balance.

Add these to your allowed_paths setting:

[
  "/v1/customers",
  "/v1/payment_intents",
  "/v1/payment_methods",
  "/v1/subscriptions",
  "/v1/prices",
  "/v1/products",
  "/v1/checkout/sessions"
]

Using Stripe SDK with Proxy

import Stripe from 'stripe';

// Configure Stripe to use Conduit Link
const stripe = new Stripe('dummy-key', {
  apiVersion: '2023-10-16',
  host: 'proxy.conduit.link',
  protocol: 'https',
  port: 443,
  basePath: '/YOUR_LINK_ID/v1',
  httpAgent: {
    defaultHeaders: {
      'X-Access-Token': 'YOUR_CONDUIT_ACCESS_TOKEN',
      // Optional: Add JWT for user-specific rate limiting
      'Authorization': 'Bearer YOUR_USER_JWT_TOKEN'
    }
  }
});

// Create a customer
const customer = await stripe.customers.create({
  email: '[email protected]',
  name: 'John Doe',
});

// Create a payment intent
const paymentIntent = await stripe.paymentIntents.create({
  amount: 2000, // $20.00
  currency: 'usd',
  customer: customer.id,
});

Direct Stripe API Call

// Create a Stripe customer without SDK
const response = await fetch('https://proxy.conduit.link/YOUR_LINK_ID/v1/customers', {
  method: 'POST',
  headers: {
    'X-Access-Token': 'YOUR_CONDUIT_ACCESS_TOKEN',
    'Content-Type': 'application/x-www-form-urlencoded',
  },
  body: new URLSearchParams({
    email: '[email protected]',
    name: 'Jane Smith',
    description: 'Premium customer',
  }),
});

const customer = await response.json();
console.log('Customer created:', customer.id);
🗺️

Google Maps

Use Google Maps APIs without exposing your API key in frontend code

Configuration

Original API URL: https://maps.googleapis.com/maps/api
Conduit Link URL: https://proxy.conduit.link/YOUR_LINK_ID

🔒 Recommended Path Restrictions

Security Tip: Only enable the specific Maps APIs you're using. This prevents unauthorized access to costly APIs like Street View or Roads.

Add these to your allowed_paths setting:

[
  "/geocode/json",
  "/place/autocomplete/json",
  "/place/details/json",
  "/directions/json",
  "/distancematrix/json",
  "/elevation/json",
  "/timezone/json"
]

Geocoding API

// Geocode an address securely
async function geocodeAddress(address) {
  const response = await fetch(
    `https://proxy.conduit.link/YOUR_LINK_ID/geocode/json?${new URLSearchParams({
      address: address,
    })}`,
    {
      headers: {
        'X-Access-Token': 'YOUR_CONDUIT_ACCESS_TOKEN',
      },
    }
  );

  const data = await response.json();
  return data.results[0]?.geometry.location;
}

// Usage
const location = await geocodeAddress('1600 Amphitheatre Parkway, Mountain View, CA');
console.log('Coordinates:', location); // { lat: 37.4224764, lng: -122.0842499 }

Places Autocomplete

// Implement places autocomplete
async function getPlaceSuggestions(input) {
  const response = await fetch(
    `https://proxy.conduit.link/YOUR_LINK_ID/place/autocomplete/json?${new URLSearchParams({
      input: input,
      types: 'establishment',
      language: 'en',
    })}`,
    {
      headers: {
        'X-Access-Token': 'YOUR_CONDUIT_ACCESS_TOKEN',
      },
    }
  );

  const data = await response.json();
  return data.predictions.map(p => ({
    description: p.description,
    placeId: p.place_id,
  }));
}

// React component example
function PlaceSearch() {
  const [query, setQuery] = useState('');
  const [suggestions, setSuggestions] = useState([]);

  useEffect(() => {
    if (query.length > 2) {
      getPlaceSuggestions(query).then(setSuggestions);
    }
  }, [query]);

  return (
    <input
      value={query}
      onChange={(e) => setQuery(e.target.value)}
      placeholder="Search for a place..."
    />
  );
}
🧠

Anthropic Claude

Use Claude API securely without client-side key exposure

Configuration

Original API URL: https://api.anthropic.com
Conduit Link URL: https://proxy.conduit.link/YOUR_LINK_ID

🔒 Recommended Path Restrictions

Security Tip: Restrict to the messages endpoint for Claude 3 models. This prevents access to account or billing endpoints.

Add these to your allowed_paths setting:

[
  "/v1/messages",
  "/v1/complete"
]

Claude API Integration

// Using Anthropic's Claude API
const response = await fetch('https://proxy.conduit.link/YOUR_LINK_ID/v1/messages', {
  method: 'POST',
  headers: {
    'X-Access-Token': 'YOUR_CONDUIT_ACCESS_TOKEN',
    'Content-Type': 'application/json',
    'anthropic-version': '2023-06-01',
    // Optional: Add JWT for user-specific rate limiting
    'Authorization': 'Bearer YOUR_USER_JWT_TOKEN'
  },
  body: JSON.stringify({
    model: 'claude-3-opus-20240229',
    max_tokens: 1024,
    messages: [
      {
        role: 'user',
        content: 'What are the key differences between REST and GraphQL?'
      }
    ],
  }),
});

const data = await response.json();
console.log(data.content[0].text);
📧

SendGrid

Send emails through SendGrid without exposing your API key

Configuration

Original API URL: https://api.sendgrid.com/v3
Conduit Link URL: https://proxy.conduit.link/YOUR_LINK_ID

🔒 Recommended Path Restrictions

Security Tip: Only allow mail sending endpoints. Block access to account management, API keys, and billing endpoints.

Add these to your allowed_paths setting:

[
  "/mail/send",
  "/mail/batch",
  "/marketing/contacts",
  "/marketing/lists"
]

Send Email via SendGrid

// Send an email using SendGrid
const response = await fetch('https://proxy.conduit.link/YOUR_LINK_ID/mail/send', {
  method: 'POST',
  headers: {
    'X-Access-Token': 'YOUR_CONDUIT_ACCESS_TOKEN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    personalizations: [
      {
        to: [{ email: '[email protected]', name: 'Recipient Name' }],
        subject: 'Hello from Conduit Link!',
      },
    ],
    from: {
      email: '[email protected]',
      name: 'Your App Name',
    },
    content: [
      {
        type: 'text/plain',
        value: 'This email was sent securely through Conduit Link!',
      },
      {
        type: 'text/html',
        value: '<p>This email was sent <strong>securely</strong> through Conduit Link!</p>',
      },
    ],
  }),
});

if (response.ok) {
  console.log('Email sent successfully!');
} else {
  console.error('Failed to send email:', await response.text());
}
📱

Twilio

Send SMS and make calls without exposing Twilio credentials

Configuration

Original API URL: https://api.twilio.com/2010-04-01
Conduit Link URL: https://proxy.conduit.link/YOUR_LINK_ID

🔒 Recommended Path Restrictions

Security Tip: Restrict to messaging and calling endpoints only. Prevent access to account settings, billing, or phone number purchasing.

Add these to your allowed_paths setting:

[
  "/Accounts/*/Messages.json",
  "/Accounts/*/Calls.json",
  "/Accounts/*/IncomingPhoneNumbers.json",
  "/Accounts/*/AvailablePhoneNumbers/*"
]

Send SMS with Twilio

// Send an SMS message
const accountSid = 'YOUR_TWILIO_ACCOUNT_SID'; // This can be public
const response = await fetch(
  `https://proxy.conduit.link/YOUR_LINK_ID/Accounts/${accountSid}/Messages.json`,
  {
    method: 'POST',
    headers: {
      'X-Access-Token': 'YOUR_CONDUIT_ACCESS_TOKEN',
      'Content-Type': 'application/x-www-form-urlencoded',
    },
    body: new URLSearchParams({
      To: '+1234567890',
      From: '+0987654321', // Your Twilio phone number
      Body: 'Hello from Conduit Link! Your verification code is: 123456',
    }),
  }
);

const message = await response.json();
console.log('Message sent:', message.sid);

Ready to Secure Your APIs?

Start using Conduit Link to protect your API keys and build secure applications.

Connect Securely. Ship Faster.

© 2025 Conduit Link. All rights reserved.