Whether the SDK is configured for a Demo-BFF-style proxy — no apiKey (the
proxy injects the real key server-side from a cookie-gated session) plus a
non-default commonBaseURL.
In this mode SDK requests attach credentials: 'include' so the proxy's
session cookie travels with them. In all other cases — direct TomTom usage
and customer-owned customServiceBaseURL integrations — credentials stay at
the browser default, so we don't break consumers whose backend responds with
Access-Control-Allow-Origin: * (the browser rejects credentialed responses
against a wildcard origin). A customer using customServiceBaseURL keeps a
real apiKey, so this stays false for them.
The apiKey test is a falsy check (not === '') on purpose: a proxy build
may overwrite the bootstrap's apiKey: '' with apiKey: undefined (e.g.
put({ apiKey: process.env.API_KEY_EXAMPLES }) when that env var is unset).
Both empty string and undefined mean "no key, the proxy injects it" — matching
how the URL builders decide whether to append key= (if (apiKey)).
Whether the SDK is configured for a Demo-BFF-style proxy — no
apiKey(the proxy injects the real key server-side from a cookie-gated session) plus a non-defaultcommonBaseURL.In this mode SDK requests attach
credentials: 'include'so the proxy's session cookie travels with them. In all other cases — direct TomTom usage and customer-ownedcustomServiceBaseURLintegrations — credentials stay at the browser default, so we don't break consumers whose backend responds withAccess-Control-Allow-Origin: *(the browser rejects credentialed responses against a wildcard origin). A customer usingcustomServiceBaseURLkeeps a realapiKey, so this stays false for them.The
apiKeytest is a falsy check (not=== '') on purpose: a proxy build may overwrite the bootstrap'sapiKey: ''withapiKey: undefined(e.g.put({ apiKey: process.env.API_KEY_EXAMPLES })when that env var is unset). Both empty string and undefined mean "no key, the proxy injects it" — matching how the URL builders decide whether to appendkey=(if (apiKey)).