Skip to content

Protected server-side SVG render API

Endpoint

POST /api/render-svg

This endpoint returns a standalone SVG rendering of the compact local-valence model. It does not load or screenshot the /molecule page.

The endpoint requires a bearer token:

http
Authorization: Bearer <token>

The server reads the expected token from:

QUANTUM_ORBITALS_API_TOKEN

The token is never stored in the application source.

Configure the VPS

Generate a strong token:

bash
openssl rand -hex 32

Create an environment file:

bash
nano /etc/quantum-orbitals.env

with:

QUANTUM_ORBITALS_API_TOKEN=replace-with-the-generated-token

Protect it:

bash
chmod 600 /etc/quantum-orbitals.env
chown root:root /etc/quantum-orbitals.env

In /etc/systemd/system/quantum-orbitals.service, add:

ini
[Service]
EnvironmentFile=/etc/quantum-orbitals.env

Then:

bash
systemctl daemon-reload
systemctl restart quantum-orbitals

Request

bash
curl -sS -X POST \
  https://app.lcserve.com/api/render-svg \
  -H "Authorization: Bearer $QUANTUM_ORBITALS_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "smiles": "N[C@@H](CS)C(=O)O",
    "render": {
      "width": 1200,
      "height": 820,
      "orbital_scale": 1.2,
      "atom_scale": 0.95,
      "show_hydrogens": true,
      "show_sigma": true,
      "show_lone_pairs": true,
      "show_pi": true,
      "show_labels": true
    }
  }' > cysteine.svg

The result is a self-contained image/svg+xml document.

Node.js

js
const token = process.env.QUANTUM_ORBITALS_API_TOKEN;

const response = await fetch(
  'https://app.lcserve.com/api/render-svg',
  {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${token}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      smiles: 'N[C@@H](CS)C(=O)O',
      render: {
        width: 1200,
        height: 820,
        orbital_scale: 1.2,
        show_lone_pairs: true,
        show_pi: true
      }
    })
  }
);

if (!response.ok) {
  throw new Error(`${response.status}: ${await response.text()}`);
}

const svg = await response.text();

Authentication behavior

  • missing/incorrect bearer token -> 401 Unauthorized
  • bearer token configured nowhere on the server -> 503 Service Unavailable
  • valid request -> 200 image/svg+xml

/api/model remains unchanged and unprotected for compatibility with the existing /molecule browser page.

Security notes

Use HTTPS at nginx. Do not pass bearer tokens in query strings. Do not commit the token or /etc/quantum-orbitals.env to source control.

Source: API_RENDER_SVG.md in the server package · updated