Authentication

Each endpoint in this reference names the credential it takes.

Credential	Used by	Sent as
Project key	Links, Segments, In-app messages, Server push	`PROJECT-KEY` and `ENVIRONMENT` headers
Scoped key	Event stream pull feed, Audit log export	`Authorization: Bearer <key>`

Keep every credential on your server. Never ship one in an app or a web page.

Shell

Bash

# Project key
curl https://sdk.sqd.link/api/v1/sdk/metrics_for_project \
  -H "PROJECT-KEY: $GROVS_PROJECT_KEY" \
  -H "ENVIRONMENT: production"
 
# Scoped key
curl https://api.sqd.link/api/v1/projects/123/event_stream \
  -H "Authorization: Bearer est_4c1f…"

Project key

AuthProject keyAuthentication ›

The project key authenticates server-to-server calls on the sdk. host. Find it in the dashboard under Developers › API Key.

One key covers both environments. The ENVIRONMENT header picks the project: production or test. Links, segments, in-app messages and campaigns created in one environment are not visible in the other.

Headers

PROJECT-KEYstringRequired

Your project key.

ENVIRONMENTstringRequired

production or test.

Errors

400PROJECT-KEY is missing, or ENVIRONMENT is not production or test.

403The key does not match a project, or enterprise_required: segments, in-app messages and server push need an active paid plan on grovs Cloud.

The project key gives full access to links, segments, in-app messages and server push in both environments. To regenerate it, contact [email protected].

Request · cURL

curl -X GET "https://sdk.sqd.link/api/v1/sdk/metrics_for_project" \
  -H "PROJECT-KEY: $GROVS_PROJECT_KEY" \
  -H "ENVIRONMENT: production"

JSON

{
  "error": "Invalid ENVIRONMENT value. Allowed: 'production', 'test'"
}

Scoped keys

AuthScoped keyAuthentication ›

A scoped key reads one thing and cannot change anything. It is not tied to a user, so it keeps working when the person who created it leaves. An instance admin creates it in the dashboard. The full key is shown once.

Key	Reads	Where to create it
Feed token `est_…`	The event stream pull feed of one project environment. 120 requests a minute per key.	Developers › Data Export › Pull feed tokens › Create feed token
Export token `aet_…`	The audit log of one instance. 60 requests a minute per key.	Settings › Audit Logs › Export tokens › Create token

Send the key as a bearer token. The responses:

401 with { "error": "Invalid or revoked token" }: the key is unknown or revoked.
403: the key belongs to another project or instance.
503: you are over the rate limit. Back off and retry.

Neither kind expires. Revoke a key in the same dashboard screen to retire it. Revocation takes effect at once.

Request · cURL

curl -X GET "https://api.sqd.link/api/v1/projects/{project_id}/event_stream?limit=500" \
  -H "Authorization: Bearer $GROVS_STREAM_KEY"

JSON

{
  "error": "Invalid or revoked token"
}

Was this page helpful?

Last updated 2026-10-26