Write keys

Every source has its own keys. Browser keys go in pages and apps. Server keys stay on your backend

On this page

• Two kinds of key
• Create a key
• Use the right key on the server
• Send a key with the HTTP API
• Rotate a key

Two kinds of key#

Both kinds use the form keyId:secret.

Key	Where it goes	Secret?
Browser key	Website code, Google Tag Manager, iOS and Android apps	No. It can only send events, so it is safe in page source and app binaries.
Server key	Your backend: the HTTP API, Node.js and Laravel SDKs	Yes. Store it like a password, in an environment variable or a secret manager.

Create a key#

1. Open Sources in the dashboard and select the source.
2. Go to the Settings tab.
3. Create a browser key or a server key and copy it immediately. The full value is only shown in the browser that created it. If you lose it, create a new one.

Use the right key on the server#

A browser key is accepted from a server, but then every event reports your server’s IP address and user agent instead of your customer’s. Ad platforms match conversions on those values, so use a server key and pass the customer’s IP and user agent with each event. The Node.js and Laravel SDKs do this for you.

Send a key with the HTTP API#

The SDKs handle authentication. When you call the HTTP API yourself, pass the key in one of these ways:

Method	Example
Basic auth (recommended)	The key is the username and the password is empty. In curl: -u 'keyId:secret:'
Header	X-Write-Key: keyId:secret
Body, batch endpoint only	"writeKey": "keyId:secret"

Rotate a key#

Create a new key on the source’s Settings tab, deploy it, and confirm events arrive in Live events before you remove the old key from your code.