Skip to main content
Create an API key under Observe → Settings → API keys in the management console. Send it as a bearer token:
The key selects the project. Authenticated server endpoints do not take a project ID in the URL.

​
Permissions

Each endpoint lists its required API key permission. Grant only the operations your integration uses; an analytics key does not need deletion or event-write permissions.

​
Key ownership, expiry and IP restrictions

  • Project keys: project owners create keys for shared integrations.
  • Personal keys: other project members can create personal keys with read permissions. Personal keys must expire within 90 days.
  • Expiry: choose the lifetime offered in the console; project keys can also remain valid until revoked. Check expiry when a previously working integration loses access.
  • IP restrictions: restrict a key to individual IP addresses or CIDR ranges. Without a restriction, it can be used from any source IP.
Keep keys in your server’s secret configuration and rotate or revoke them when access requirements change.

​
SDK collection is separate

The Observe SDKs send to POST /observe/events/{projectID} without a bearer API key. The SDK manages this transport using the project ID and API base URL. Browser origin checks still apply. Use POST /observe/events with an API key only for server-side ingestion. A scoped API key is not an SDK initialization setting.