Authentication and API keys

Secret keys for your server, publishable keys for the browser, and test against live.

Every API request carries a secret key in the Authorization header as a bearer token.

Authorization: Bearer dsk_live_...

Two kinds of key

• Secret keys (dsk_test_, dsk_live_) can do anything the API can. Keep them on your server. They are shown once, when you create them; after that the console shows only the last four characters.
• Publishable keys (dpk_test_, dpk_live_) are safe in a browser. They only identify your platform to the miniplayer loader, and only from origins you allow.

What a key looks like

DialerSeat keys start with dsk_ (secret) or dpk_ (publishable), then test_ or live_. The last six characters are a checksum, so a key with a typo or a missing character is rejected with a message that says so, before anything else happens. Webhook signing secrets start with dswh_.

Keys in a browser

Test secret keys work from a web page, so you can try the API from a test page or the playground. Live secret keys are refused from any browser: if a request carries an Origin header, a live key gets 403 and nothing runs. Keep live keys on your server.

Test and live

Test keys see only test data and never dial. Live keys see only live data and dial once live dialing is active. A seat, campaign or lead made with a test key does not exist for a live key.

Rotating a key

Create the new key, deploy it, then revoke the old one. Revoking is immediate and cannot be undone. If a secret key leaks, revoke it first.