API keys

Every request to the Invitebase API authenticates with an API key. The key encodes two things: its type (secret or publishable) and its mode (test or live). There is no separate sandbox host — you switch environments by switching keys.

Key types

# Secret key — server-side
curl https://api.invitebase.com/v1/referrals \
  -H "Authorization: Bearer $INVITEBASE_SECRET_KEY"

# Publishable key — what the SDKs send under the hood
curl https://api.invitebase.com/v1/events \
  -H "X-Publishable-Key: pk_test_8f3kz2m9q4w7x1c5" \
  -H "Content-Type: application/json" \
  -d '{"name": "signup", "referred_user_id": "usr_123"}'

Secret keys have full access to every /v1/ resource: campaigns, referrers, referrals, rewards, balance, webhook endpoints. Treat them like passwords — anyone holding a live secret key can read your referral data and approve rewards.

Publishable keys are safe to embed in shipped apps. They are limited to operations an end-user's device legitimately needs:

• Ingesting events (POST /v1/events)
• Identifying a referrer and creating referral links
• Reading campaign info and the current user's own referral progress (for in-app promotion surfaces)

A publishable key can never read other users' data, list referrals, change campaign config, approve rewards, or touch the balance. Calling a secret-only endpoint with a publishable key returns a 403 with code key_type_not_allowed — see Errors.

Creating keys

Create keys in the dashboard under Developer tools → API keys (dashboard.invitebase.com):

1. Choose the type (secret or publishable) and mode (test or live).
2. Give the key a name that says where it will live — production-api, ci, ios-app. Names are how you audit and roll keys later.
3. Copy the key immediately. The full key is shown exactly once, at creation. Invitebase stores only a hash, so it can never be displayed again — if you lose it, roll it.

The dashboard shows each key's name, prefix, creation date, and last used timestamp, so stale keys are easy to spot and revoke.

What's next