Files

Benito Rodríguez 9befb8db6c docs: add SECURITY.md and API_KEYS.md documentation

- Create SECURITY.md with vulnerability reporting policy
- Add environment variables & secrets best practices
- Document input validation and rate limiting strategies
- Create docs/API_KEYS.md with step-by-step API credential guides
  - IGDB OAuth 2.0 via Twitch setup
  - RAWG API key simple registration
  - TheGamesDB API key registration
- Update README.md with security and API configuration sections
- Add tests/documentation.spec.ts with 12 validation tests

2026-02-12 20:17:58 +01:00

2.5 KiB

Raw Blame History

Obtaining API Keys

This guide explains how to get credentials for each metadata service.

IGDB (Internet Game Database)

IGDB uses OAuth 2.0 via Twitch. Steps:

Go to Twitch Developer Console
Sign in with your Twitch account (create one if needed)
Click "Create Application"
- Name: "Quasar" (or your app name)
- Category: Select relevant category
- Accept terms, click Create
You'll see:
- Client ID — Copy this
- Click "New Secret" to generate Client Secret — Copy this
Go to Settings → OAuth Redirect URLs
- Add: http://localhost:3000/oauth/callback (development)
- For production: https://yourdomain.com/oauth/callback

In your .env file:

IGDB_CLIENT_ID=your_client_id
IGDB_CLIENT_SECRET=your_client_secret

Start Quasar, it will use IGDB automatically

Rate Limit: 4 requests/second

RAWG (Rawg.io)

RAWG has a simpler API Key approach:

Go to RAWG Settings
Sign up if needed, then login
Find "API Key" section
Click "Create new key" (if needed) or copy existing key
In your .env file:
```
RAWG_API_KEY=your_api_key_here
```
Start Quasar

Rate Limit: 20 requests/second (free tier)

Note: RAWG requires attribution in UI (include "Powered by RAWG" somewhere visible)

TheGamesDB (thegamesdb.net)

TheGamesDB uses a simple API Key:

Go to TheGamesDB API
Find "API Key" section (free registration required)
Register or login
Copy your API key
In your .env file:
```
THEGAMESDB_API_KEY=your_api_key_here
```
Start Quasar

Rate Limit: 1 request/second (free tier)

Testing Without Real Keys

For development/testing:

Leave API keys as your_*_here in .env.local
Quasar will gracefully degrade and show limited metadata
Frontend will still work with manual game entry

Production Deployment

For production:

Generate new keys on each service (don't reuse dev keys)
Store keys in Gitea Secrets (for CI/CD)
Or use environment variables on your hosting provider
Rotate keys every 3 months
Monitor rate limits in service dashboards

Troubleshooting

"IGDB_CLIENT_ID not found" → Check .env file exists and has correct format

"429 Too Many Requests" → Rate limit exceeded, wait and retry

"Invalid API Key" → Copy key exactly (no spaces), verify it's active on service website

2.5 KiB Raw Blame History