REST API authentication

Create scoped secret keys and send authenticated requests to the InAppify server-to-server REST API.

Send the project's secret key as a Bearer token on every request:

If you do not have a key, start with creating a secret key and distinguishing SDK keys.

Authorization: Bearer YOUR_SECRET_API_KEY
Accept: application/json
Content-Type: application/json

Offering endpoints also require X-InAppify-App-ID: YOUR_APP_IDENTIFIER.

curl "https://api.example.com/api/v1/subscribers/customer_123" \
  -H "Authorization: Bearer YOUR_SECRET_API_KEY" \
  -H "Accept: application/json"

Each endpoint has an independent ability. Grant only the abilities required by that backend integration. A missing or invalid key returns 401; a valid key without the required ability returns 403 with code API_KEY_ABILITY_DENIED.

The complete key is displayed only when issued. Store it in a server-side secret manager or environment variable; never log or commit it.

InAppify REST API reference

Responses, errors, and rate limits

REST API authentication

Related guides