Skip to main content
The TrackRev API authenticates with an API key sent as a Bearer token. The key — not the request origin — is what authorises access, and every key is scoped to one workspace.

​
Create a key

1

Open Developers

Go to Settings → Developers and use the API keys section.
2

Choose a scope and label

Give the key a label (e.g. “Production widget”) and pick a scope.
3

Copy it once

The full key is shown once at creation — “Copy this key now — it won’t be shown again.” Store it securely.

​
Key scopes

Secret key

Prefix lk_. Server-only, full access. Use for reading analytics and any endpoint that handles your data. Never expose it in a browser.

Publishable key

Prefix pk_. Browser-safe. Only permitted on the referral enroll and report-signup endpoints. Use it in the in-app widget.

​
Send the key

Pass the key in the Authorization header:
Secret keys (lk_…) grant full read access to your workspace’s data — keep them server-side. Publishable keys (pk_…) are safe in the browser but can only enroll referrers and report signups.

​
Revoke a key

From Settings → Developers, click revoke on any key. Revoked keys stop working immediately — “Apps using it will stop working immediately.” Keys also show a Last used timestamp so you can spot unused ones.
TrackRev stores only a hash of each key, never the key itself — which is why it can only be shown at creation time. If you lose a key, revoke it and create a new one.