Looker CORS API Proxy Pattern (General)

This skill describes the Scoped API Token Proxy pattern. This architectural pattern allows frontend applications to make direct, performant API calls to Looker from the browser while maintaining strict security by delegating authentication to a secure backend.

1. The Core Pattern

The pattern solves the "Browser Secret Problem": Browsers cannot safely hold API Client Secrets, but direct API access (CORS) requires an authentication token.

Architectural Components

1. Application Frontend: The client-side UI that requires data. It makes direct fetch or XHR calls to Looker's API endpoints.
2. Application Backend (The Proxy/Signer): A secure server-side component that holds Looker Admin credentials. It does not proxy data; it only proxies Identity and Authentication.
3. Looker API: The source of data, configured to trust the Frontend's origin via CORS.

2. The Authentication Delegation Flow

Instead of the backend fetching data and passing it back, the backend provides the frontend with the "keys" to fetch the data itself.

1. Identity Verification: The Frontend authenticates with the Application Backend using the app's standard auth mechanism (JWT, Session Cookie, etc.).