Authentication
Use secret keys on your server and publishable keys in the browser.
| Key type | Prefix | Where to use it | Can do |
|---|---|---|---|
| Secret | sk_live_ / sk_test_ | Your server only | Everything |
| Publishable | pk_live_ / pk_test_ | Browser script | Record clicks |
| Restricted | rk_live_ / rk_test_ | Internal tools | Only the scopes you pick |
Send the key as a bearer token:
curl https://api.referralapi.example/v1/referrers \
-H "Authorization: Bearer sk_live_51Hx..."If a secret key leaks
Roll it immediately in Settings → API keys. The old key stops working after 24 hours, or right away if you choose Expire now.
How is this guide?