> ## Documentation Index
> Fetch the complete documentation index at: https://doc.trackrev.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Generate secret and publishable API keys and send them as Bearer tokens.

The TrackRev API authenticates with an API key sent as a Bearer token. The key — not the request
origin — is what authorises access, and every key is scoped to one workspace.

## Create a key

<Steps>
  <Step title="Open Developers">
    Go to **Settings → Developers** and use the **API keys** section.
  </Step>

  <Step title="Choose a scope and label">
    Give the key a label (e.g. *"Production widget"*) and pick a scope.
  </Step>

  <Step title="Copy it once">
    The full key is shown **once** at creation — *"Copy this key now — it won't be shown again."*
    Store it securely.
  </Step>
</Steps>

## Key scopes

<CardGroup cols={2}>
  <Card title="Secret key" icon="lock">
    Prefix `lk_`. **Server-only, full access.** Use for reading analytics and any endpoint that
    handles your data. Never expose it in a browser.
  </Card>

  <Card title="Publishable key" icon="globe">
    Prefix `pk_`. **Browser-safe.** Only permitted on the referral enroll and report-signup
    endpoints. Use it in the in-app [widget](/developers/referral-widget).
  </Card>
</CardGroup>

## Send the key

Pass the key in the `Authorization` header:

```bash theme={null}
curl "https://app.trackrev.io/api/v1/links?days=30" \
  -H "Authorization: Bearer lk_live_3f8a92c1_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
```

<Warning>
  Secret keys (`lk_…`) grant full read access to your workspace's data — keep them server-side.
  Publishable keys (`pk_…`) are safe in the browser but can only enroll referrers and report
  signups.
</Warning>

## Revoke a key

From **Settings → Developers**, click revoke on any key. Revoked keys stop working immediately —
*"Apps using it will stop working immediately."* Keys also show a **Last used** timestamp so you can
spot unused ones.

<Note>
  TrackRev stores only a hash of each key, never the key itself — which is why it can only be shown
  at creation time. If you lose a key, revoke it and create a new one.
</Note>