Authentication and API keys

Send your API key in the Authorization header of every request to POST /v1/notifications and GET /v1/notifications/{id}. A key belongs to one project and can only reach that project's recipients and notifications.

Authorization: Bearer sk_live_9fQ2…

Key format#

A key is sk_live_ or sk_test_ followed by 32 letters and digits. Anything else is rejected before Push looks it up.

sk_live_<32 letters and digits>sk_test_<32 letters and digits>

Live and test keys#

• Live keys (sk_live_…) send real notifications and count toward usage.
• Test keys (sk_test_…) run the same validation and record one attempt per connected browser, marked accepted at once. They send nothing to any browser and never count toward usage. The recipient still needs at least one connected browser.
• Both modes share the project's idempotency keys: a key used with a test request cannot be reused by a live request with a different body.

Creating and revoking keys#

• Create keys in the dashboard, under API keys in a project. Creating a project needs a verified email address.
• The full key is shown once, when you create it. Push stores only its SHA-256 hash and keeps the first 12 characters so you can tell keys apart. If you lose a key, revoke it and create a new one.
• Revoking is immediate: the next request with that key fails with 401 UNAUTHORIZED. It cannot be undone.
• A project can have up to 10 active keys; revoked keys do not count. An account can have up to 10 projects.
• Each key shows when it was last used. That time is updated at most once a minute.

Keep keys on the server#

Authentication errors#