Whether the SDK is configured for a credentials proxy, such as the demos proxy.
That is the case with no apiKey and a non-default commonBaseURL. The proxy injects
the real key server-side from a cookie-gated session.
In this mode, SDK requests attach credentials: 'include' so the proxy's session cookie
travels with them. Otherwise, as with direct TomTom usage or a customer-owned proxy that
keeps a real apiKey, credentials stay at the browser default. This keeps backends that
respond with Access-Control-Allow-Origin: * working, since the browser rejects
credentialed responses against a wildcard origin.
The apiKey test is a falsy check, not === '', because a proxy build may overwrite the
bootstrap's apiKey: '' with apiKey: undefined, for example with
put({ apiKey: process.env.API_KEY_EXAMPLES }) when that env var is unset. Both mean the
proxy injects the key, which matches how the URL builders decide whether to append key=
(if (apiKey)).
Whether the SDK is configured for a credentials proxy, such as the demos proxy.
That is the case with no
apiKeyand a non-defaultcommonBaseURL. The proxy injects the real key server-side from a cookie-gated session.In this mode, SDK requests attach
credentials: 'include'so the proxy's session cookie travels with them. Otherwise, as with direct TomTom usage or a customer-owned proxy that keeps a realapiKey, credentials stay at the browser default. This keeps backends that respond withAccess-Control-Allow-Origin: *working, since the browser rejects credentialed responses against a wildcard origin.The
apiKeytest is a falsy check, not=== '', because a proxy build may overwrite the bootstrap'sapiKey: ''withapiKey: undefined, for example withput({ apiKey: process.env.API_KEY_EXAMPLES })when that env var is unset. Both mean the proxy injects the key, which matches how the URL builders decide whether to appendkey=(if (apiKey)).