API keys and security

Public SDK documentation uses YOUR_API_KEY as an example value. It is not an active key and will not authenticate a request. This page does not look up keys, reveal signed-in users' credentials or provide a public API-key generator.

Obtain your own app key

Sign in and open the app you own or are authorized to manage.
Open API Keys. Your role must allow key management.
Create or choose a key associated with that app. Use separate development and production keys where practical.
Add it only to your own integration configuration. Keep the public examples and shared documentation unchanged.

If you cannot access API Keys, ask your app or team owner for the appropriate access. Making the guides public does not change dashboard permissions.

Keep different credentials separate

Credential	Where it belongs
App-specific SDK key	Your app's integration configuration; treat distribution as potentially extractable
Multi-app or administrative API key	A trusted server or authorized operator environment, not a mobile client
Dashboard login, password or account access token	Private account/session tooling, never SDK examples
AI provider keys, store credentials or signing keys	Private server-side or build-system configuration, never public HTML or mobile bundles

Build-time variables and ignored local files help avoid committing credentials. They do not make a key embedded in an installed application impossible to recover. Do not use an SDK key as proof that a client is trusted or as a replacement for your own user authorization.

Direct SDK API requests

SDK initialization configures authentication for SDK-managed requests. For an authorized server-side diagnostic request, the SDK API accepts the api-key header. Use HTTPS and keep credentials out of URLs.

curl --request GET 'https://smartlinks.live/api/v1/app' \
  --header 'Accept: application/json' \
  --header 'api-key: YOUR_API_KEY'

This example deliberately contains no working credential. Only run a real-key version in your private environment, and avoid placing real credentials in shell history or shared logs. A successful request can return app information; do not paste its full response into a public issue.

The protected SDK endpoint returns HTTP 401 when the key is missing or invalid:

{
  "success": false,
  "message": "Invalid or missing API key."
}

The dashboard Data API and its app-selection rules are a separate integration surface. Do not substitute dashboard session tokens for the app SDK key.

Troubleshooting

Symptom	What to check
`401`	Placeholder still present, missing header, incorrect or inactive key
`403`	The account, key, app access or requested feature is not permitted; do not bypass the restriction
`422`	Validate the request fields against the SDK method you are using
`429`	Slow down and respect `Retry-After` when provided; avoid immediate retry loops
No events in the dashboard	Matching app and bundle IDs, initialization result, network connectivity, event time range and queued delivery
Link opens the website	Domain association, Android signing fingerprints or iOS Team ID, target path and installed-app configuration

Only include redacted errors and non-sensitive event samples when seeking help. Disable verbose SDK debugging in release builds.

If a key is exposed

Use the private key-management page to revoke the exposed key and issue a replacement. Update affected applications or server integrations, and coordinate rollout to avoid breaking older clients. Removing a key from a screenshot or repository does not invalidate copies that already exist.

The public documentation does not rotate or revoke any existing key. Your current integrations are unchanged.