Authentication

Every request to the Events API must be authenticated with an API key. The key identifies your RevBridge account, so no separate customer ID header is needed.

Key types

RevBridge has two kinds of keys. Use the right one for where your code runs.

Key	Prefix	Where it runs	Scope
Secret key	`rbk_` / `rbak_`	Server-side only	Full account access: ingest events, read data, send messages
Publishable key	`rbpk_`	Browser or mobile (safe to expose)	Ingest events only, restricted to `/ingest/*`

Secret keys authenticate the server-side Events API described on this page. Publishable keys authenticate the Web SDK in the browser: they carry a single ingest:write permission and are rejected outside the ingest endpoint, so exposing one only lets a page send events — never read data or send messages.

Generating API keys

Open Settings

Navigate to Settings → API Keys in the RevBridge AI dashboard.

Create a new key

Click Create API Key, give it a descriptive name (e.g., production-backend, staging-etl), and confirm.

Copy the key

The full API key is shown only once. Copy it immediately and store it in your secrets manager or environment variables.

API keys cannot be retrieved after creation. If you lose a key, revoke it and create a new one.

Required headers

Every API request must include the Authorization header:

Header	Description	Example
`Authorization`	Bearer token with your API key	`Bearer rbk_a1b2c3d4...`

Example requests

cURL

curl -X POST https://api.revbridge.ai/ingest/events \
  -H "Authorization: Bearer rbk_a1b2c3d4e5f6g7h8" \
  -H "Content-Type: application/json" \
  -d '{
    "users": [
      {
        "identifiers": { "email": "jane@example.com" },
        "events": [
          { "event_name": "page_view", "page": "/pricing" }
        ]
      }
    ]
  }'

JavaScript (fetch)

const response = await fetch("https://api.revbridge.ai/ingest/events", {
  method: "POST",
  headers: {
    "Authorization": "Bearer rbk_a1b2c3d4e5f6g7h8",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    users: [
      {
        identifiers: { email: "jane@example.com" },
        events: [
          { event_name: "page_view", page: "/pricing" },
        ],
      },
    ],
  }),
});

const data = await response.json();
console.log(data);

Python (requests)

import requests

response = requests.post(
    "https://api.revbridge.ai/ingest/events",
    headers={
        "Authorization": "Bearer rbk_a1b2c3d4e5f6g7h8",
        "Content-Type": "application/json",
    },
    json={
        "users": [
            {
                "identifiers": {"email": "jane@example.com"},
                "events": [
                    {"event_name": "page_view", "page": "/pricing"}
                ],
            }
        ]
    },
)

print(response.json())

Security best practices

Follow these guidelines to keep your API keys safe.

Never expose secret keys in frontend code. Secret rbk_ / rbak_ keys carry full account access and must only be used from server-side applications, where they can’t be inspected. For browser or mobile code, use a publishable rbpk_ key via the Web SDK instead.
Use environment variables. Store keys in your secrets manager or .env files — never hardcode them in source code.
Rotate keys periodically. Create a new key, update your systems, then revoke the old one. RevBridge supports multiple active keys to enable zero-downtime rotation.
Use separate keys per environment. Create distinct keys for development, staging, and production so you can revoke one without affecting others.
Restrict access. Only team members who need API access should have visibility into key values.

Getting Started

Events API

Web SDK

Reference

Key types

Generating API keys

Required headers

Example requests

Security best practices

​Key types

​Generating API keys

​Required headers

​Example requests

​Security best practices

Key types

Generating API keys

Required headers

Example requests

Security best practices