Getting started FAQ

Can I sign up without talking to EdgeKit?

No. There is no self-serve sign-up and no free offer. You book a demo, and EdgeKit opens your organization’s account.

Can I create a second organization myself?

No. Creating any organization after your first needs EdgeKit.

Is my organization’s data shared with other organizations?

No. Each organization has its own database and its own sign-in instance, and shares neither with any other organization. No query can read across two organizations. A site id in a request can only ever select one of your own organization’s sites.

How do I add another site?

You cannot add one from the console: it has no action that creates a site. EdgeKit creates your first site when it sets up your organization, from the name, domain and browser origins you give it.

Why is every browser request refused with 403 forbidden?

The browser’s Origin is not on the site’s Allowed list, and the message is This origin is not allowed for the selected site.. Check three things:

• The list is not empty. An empty list refuses every browser request that carries an Origin, and the Sites list marks the site denies all.
• Each origin is written exactly as the browser sends it: scheme, host and port, with no trailing slash. https://www.example.com and https://example.com are two different origins. An entry containing * never matches anything.
• You deployed after changing the list. Requests read the list from your newest deployment, not from the draft.

I changed a site setting and nothing happened. Why?

What you save is the draft, and requests read your newest deployment. Stage and deploy the change in Stage and deploy a change.

What do 400 Missing site id., 404 Unknown site. and 503 from decide mean?

• 400 bad_request, Missing site id.: the request had no x-edgekit-site-id header. The browser client and the server client send it from the siteId you give them.
• 404 not_found, Unknown site.: the id names no site in your newest deployment, or the site is not active. An unknown site and a disabled one answer the same way.
• 503 service_unavailable from decide: decide is not set up for your organization, and the message says what is missing, for example This tenant has no deployed configuration.. EdgeKit makes your organization’s first deploy when it opens your account, so a new site does not start in this state.

Do I have to mount /edgekit/ on my own domain?

Only if you want EdgeKit to know who the user is and your tenant host is on another domain than your site. The browser client can call your tenant host directly through its baseUrl option. Those requests carry the sign-in session when the user signed in through the tenant host and it shares your site’s domain, such as edgekit.example.com for www.example.com, or when your organization’s cookie domain covers both hosts. Otherwise decide still answers 200, as for an anonymous device, and calls that need a signed-in user are refused. The relative /edgekit/ path on your own domain always identifies the user. See Get started and Call the tenant host directly.

Do I have to change my Content Security Policy?

Not with the mount. Every request goes to your own origin, so connect-src 'self' already allows it, and the site proxy serves its script from /edgekit/proxy.js, which script-src 'self' allows. Its panel is styled by an inline <style> element, so with the site proxy your style-src, or default-src when there is none, must allow 'unsafe-inline'. If your pages call your tenant host directly instead, add your tenant host to connect-src.

Does my page need an API key?

No, and it must never hold one. The browser client has no credential: EdgeKit accepts its requests from the origins on your site’s Allowed list and identifies the user by their sign-in cookie. An API key is for your servers only.

Can one API key serve two sites?

No. A key is pinned to the site it was issued on. Sent with another site’s id it gets 403 forbidden, This key is not pinned to the selected site.. Three sites need three keys.

I lost an API key. Can I see it again?

No. EdgeKit stores only a hash of the key, so it is shown once, when you issue it. Issue a new key, move your server to it, then revoke the old one. A revoked key gets 401 unauthorized from its next request on and cannot be turned back on.

How can I tell whether a key is in use?

The API keys section of the site screen shows each key’s Requests count and when it was Last used, with its status: active, revoked or expired.

What happens to my page when EdgeKit is slow or cannot be reached?

The browser client’s decide never throws for a failed decision. After 2 seconds, or the timeoutMs you set, every feature you asked for answers unavailable, and your page renders what it shows for that state. A network failure, a 429 or a 5xx answers unavailable the same way, and nothing is retried for you. The server client waits 5 seconds by default.

decide throws EdgeKitConfigError only for a setup mistake: no feature names or more than 32, or a 400, 401, 403 or 404 such as an unknown site or an origin missing from the Allowed list.

Does an anonymous page view create a user?

No. Until someone signs in, EdgeKit keeps anonymous state for their browser as a device, and anonymous browsing never creates a user.

Who in my organization can do the setup?

The Owner and Admin roles can change a site, issue and revoke API keys, stage and deploy. The Developer role can stage a change but cannot deploy it, change a site or issue a key.