What is an AtroUI Host API?

A Host API is a thin Next.js App Router API route running on your own server that delegates processing to secure, pre-hardened validation and security handlers inside the local atroui npm package.

Does AtroUI host any of my AI or SMTP keys?

No. AtroUI operates under a strict Bring Your Own Keys (BYOK) model. All secret tokens, API keys, and SMTP server passwords remain in your local environment variables and are never transmitted to AtroUI's documentation hosts.

How are Host APIs secured against spam and abuse?

Every handler includes out-of-the-box production-ready safeguards: sliding-window rate limits (in-memory or Upstash Redis REST/Vercel KV), automatic honeypot spam fields, payload size capping (8 MB request size limit), and attachment filters.

Getting started

Host APIs

Own the UI in your repo. Borrow the boring API security. Bring your own keys. Walk the trays below — one idea at a time. Related: Next.js forms · Host API glossary · Host APIs blog post.

Guide

01 / 07

UI posts to your /api. Handlers live in atroui.

What Host APIs are

Registry form and tool UIs post to /api/* on your Next.js app. Each route is a thin stub that calls a published handler:

import { handleContactPost } from "atroui/api/contact"

export const runtime = "nodejs"

export async function POST(req: Request) {
  return handleContactPost(req)
}

Handlers in atroui/api/* already include validation, honeypot checks, body caps, and rate limits. You bring SMTP/Resend or HF/Gemini/xAI keys in your env.

Installation Registry Launch workflow Contact form

FAQ

What is an AtroUI Host API?: A Host API is a thin Next.js App Router API route running on your own server that delegates processing to secure, pre-hardened validation and security handlers inside the local atroui npm package.
Does AtroUI host any of my AI or SMTP keys?: No. AtroUI operates under a strict Bring Your Own Keys (BYOK) model. All secret tokens, API keys, and SMTP server passwords remain in your local environment variables and are never transmitted to AtroUI's documentation hosts.
How are Host APIs secured against spam and abuse?: Every handler includes out-of-the-box production-ready safeguards: sliding-window rate limits (in-memory or Upstash Redis REST/Vercel KV), automatic honeypot spam fields, payload size capping (8 MB request size limit), and attachment filters.