API key types
| Type | Where it lives | Use for |
|---|---|---|
SDK | Mobile / web client | Identify users, register tokens, tags, events |
REST | Your server only | Send notifications, server-side admin |
Sending credentials
Pass the key in any of these forms:
http
Authorization: Bearer ek_rest_...
Authorization: Basic ek_rest_...
X-Api-Key: ek_rest_...Dashboard auth
The operator dashboard uses Firebase Google sign-in. Dashboard routes under /projects require a Firebase ID token — separate from project API keys.
Identity verification (SDK)
When enabled on a project, SDK user calls must include an HMAC-SHA256 of external_id using the project secret (server-side only). See Project settings → Security.
warning
Warning
Never embed REST keys or APNs/FCM secrets in a mobile app. SDK keys are scoped for client ingestion; they cannot send arbitrary broadcasts.