> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corbado.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Observe API authentication

> Authenticate server requests with scoped Observe API keys.

Create an API key under [**Observe → Settings → API keys**](https://app.corbado.com/observe/settings/api-keys) in the management console. Send it as a bearer token:

```bash theme={null}
curl 'https://api.cloud.corbado.io/v1/observe/timeSeriesDefinitions' \
  --header "Authorization: Bearer $CORBADO_OBSERVE_API_KEY"
```

The key selects the project. Authenticated server endpoints do not take a project ID in the URL.

## Permissions

Each endpoint lists its required API key permission. Grant only the operations your integration uses; an analytics key does not need deletion or event-write permissions.

| Task | Example permission |
| - | - |
| Read time series and funnel metrics | `observe:timeSeries:read` |
| Search flows | `observe:flow:read` |
| Search subflows | `observe:subFlows:read` |
| Search events | `observe:events:read` |
| Search users | `observe:user:read` |
| Search identifier submissions | `observe:identifier:read` |
| Download table exports | `observe:tableExports:read` |
| Export user data | `observe:dataExports:read` |
| Request user-data deletion | `observe:dataDeletionJobs:write` |
| Read deletion status | `observe:dataDeletionJobs:read` |
| Send server-side events | `observe:events:write` |

## Key ownership, expiry and IP restrictions

* **Project keys:** project owners create keys for shared integrations.
* **Personal keys:** other project members can create personal keys with read permissions. Personal keys must expire within 90 days.
* **Expiry:** choose the lifetime offered in the console; project keys can also remain valid until revoked. Check expiry when a previously working integration loses access.
* **IP restrictions:** restrict a key to individual IP addresses or CIDR ranges. Without a restriction, it can be used from any source IP.

Keep keys in your server's secret configuration and rotate or revoke them when access requirements change.

## SDK collection is separate

The Observe SDKs send to `POST /observe/events/{projectID}` without a bearer API key. The SDK manages this transport using the project ID and API base URL. Browser origin checks still apply.

Use `POST /observe/events` with an API key only for [server-side ingestion](/api-reference/observe/send-events). A scoped API key is not an SDK initialization setting.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.