> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corbado.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Observe API authentication

> Authenticate server requests with scoped Observe API keys.

Create an API key under **Observe → Settings → API keys** in the management console. Send it as a bearer token:

```bash theme={null}
curl 'https://api.cloud.corbado.io/v1/observe/timeSeriesDefinitions' \
  --header "Authorization: Bearer $CORBADO_OBSERVE_API_KEY"
```

The key selects the project. Authenticated server endpoints do not take a project ID in the URL.

## Permissions

Each endpoint lists its required API key permission. Grant only the operations your integration uses; an analytics key does not need deletion or event-write permissions.

| Task                                | Example permission               |
| ----------------------------------- | -------------------------------- |
| Read time series and funnel metrics | `observe:timeSeries:read`        |
| Search flows                        | `observe:flow:read`              |
| Search subflows                     | `observe:subFlows:read`          |
| Search events                       | `observe:events:read`            |
| Search users                        | `observe:user:read`              |
| Download table exports              | `observe:tableExports:read`      |
| Export user data                    | `observe:dataExports:read`       |
| Request user-data deletion          | `observe:dataDeletionJobs:write` |
| Read deletion status                | `observe:dataDeletionJobs:read`  |
| Send server-side events             | `observe:events:write`           |

## Key ownership, expiry and IP restrictions

* **Project keys:** project owners create keys for shared integrations.
* **Personal keys:** other project members can create personal keys with read permissions. Personal keys must expire within 90 days.
* **Expiry:** choose the lifetime offered in the console; project keys can also remain valid until revoked. Check expiry when a previously working integration loses access.
* **IP restrictions:** restrict a key to individual IP addresses or CIDR ranges. Without a restriction, it can be used from any source IP.

Keep keys in your server's secret configuration and rotate or revoke them when access requirements change.

## SDK collection is separate

The Observe SDKs send to `POST /observe/events/{projectID}` without a bearer API key. The SDK manages this transport using the project ID and API base URL. Browser origin checks still apply.

Use `POST /observe/events` with an API key only for [server-side ingestion](/api-reference/observe/send-events). A scoped API key is not an SDK initialization setting.