> ## Documentation Index
> Fetch the complete documentation index at: https://docs.revbridge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Secure your API requests with API keys.

Every request to the Events API must be authenticated with an API key. The key identifies your RevBridge account, so no separate customer ID header is needed.

## Key types

RevBridge has two kinds of keys. Use the right one for where your code runs.

| Key                 | Prefix           | Where it runs                      | Scope                                                        |
| ------------------- | ---------------- | ---------------------------------- | ------------------------------------------------------------ |
| **Secret key**      | `rbk_` / `rbak_` | Server-side only                   | Full account access: ingest events, read data, send messages |
| **Publishable key** | `rbpk_`          | Browser or mobile (safe to expose) | Ingest events only, restricted to `/ingest/*`                |

Secret keys authenticate the server-side Events API described on this page. Publishable keys authenticate the [Web SDK](/developer/web-sdk) in the browser: they carry a single `ingest:write` permission and are rejected outside the ingest endpoint, so exposing one only lets a page send events — never read data or send messages.

## Generating API keys

<Steps>
  <Step title="Open Settings">
    Navigate to **Settings → API Keys** in the RevBridge AI dashboard.
  </Step>

  <Step title="Create a new key">
    Click **Create API Key**, give it a descriptive name (e.g., `production-backend`, `staging-etl`), and confirm.
  </Step>

  <Step title="Copy the key">
    The full API key is shown **only once**. Copy it immediately and store it in your secrets manager or environment variables.
  </Step>
</Steps>

<Warning>
  API keys cannot be retrieved after creation. If you lose a key, revoke it and create a new one.
</Warning>

## Required headers

Every API request must include the `Authorization` header:

| Header          | Description                    | Example                  |
| --------------- | ------------------------------ | ------------------------ |
| `Authorization` | Bearer token with your API key | `Bearer rbk_a1b2c3d4...` |

## Example requests

<Accordion title="cURL">
  ```bash theme={null}
  curl -X POST https://api.revbridge.ai/ingest/events \
    -H "Authorization: Bearer rbk_a1b2c3d4e5f6g7h8" \
    -H "Content-Type: application/json" \
    -d '{
      "users": [
        {
          "identifiers": { "email": "jane@example.com" },
          "events": [
            { "event_name": "page_view", "page": "/pricing" }
          ]
        }
      ]
    }'
  ```
</Accordion>

<Accordion title="JavaScript (fetch)">
  ```javascript theme={null}
  const response = await fetch("https://api.revbridge.ai/ingest/events", {
    method: "POST",
    headers: {
      "Authorization": "Bearer rbk_a1b2c3d4e5f6g7h8",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      users: [
        {
          identifiers: { email: "jane@example.com" },
          events: [
            { event_name: "page_view", page: "/pricing" },
          ],
        },
      ],
    }),
  });

  const data = await response.json();
  console.log(data);
  ```
</Accordion>

<Accordion title="Python (requests)">
  ```python theme={null}
  import requests

  response = requests.post(
      "https://api.revbridge.ai/ingest/events",
      headers={
          "Authorization": "Bearer rbk_a1b2c3d4e5f6g7h8",
          "Content-Type": "application/json",
      },
      json={
          "users": [
              {
                  "identifiers": {"email": "jane@example.com"},
                  "events": [
                      {"event_name": "page_view", "page": "/pricing"}
                  ],
              }
          ]
      },
  )

  print(response.json())
  ```
</Accordion>

## Security best practices

<Tip>
  Follow these guidelines to keep your API keys safe.
</Tip>

* **Never expose secret keys in frontend code.** Secret `rbk_` / `rbak_` keys carry full account access and must only be used from server-side applications, where they can't be inspected. For browser or mobile code, use a publishable `rbpk_` key via the [Web SDK](/developer/web-sdk) instead.
* **Use environment variables.** Store keys in your secrets manager or `.env` files — never hardcode them in source code.
* **Rotate keys periodically.** Create a new key, update your systems, then revoke the old one. RevBridge supports multiple active keys to enable zero-downtime rotation.
* **Use separate keys per environment.** Create distinct keys for development, staging, and production so you can revoke one without affecting others.
* **Restrict access.** Only team members who need API access should have visibility into key values.