Skip to content
Tracepointer
Documentation

Sending data

API keys and scopes

1 min read

Keys are created per company on the API keys screen. There are two kinds, and the difference is where they are allowed to be.

  • pk_live_… is public. Write only, tracking scopes, restricted to the domains you name. It is safe in a browser because there is nothing it can read.
  • sk_live_… is secret. Server side, full scopes, and it must never reach a browser or a repository.

Scopes

  • events.write records events, page views and conversions.
  • leads.write creates and updates leads.
  • bookings.write creates and updates bookings.
  • links.write creates tracking links.
  • reports.read reads figures, campaigns and links.

How they are stored

Only a SHA-256 digest is kept, with the prefix in clear so a key can be recognised in a list. A key shown once is shown once: if it is lost, issue another and revoke the old one. Nobody here can read it back to you.

Send the key as Authorization: Bearer …. Requests are rate limited per key, and a revoked key is refused immediately rather than at the end of its period.