Skip to main content

Application API keys

An application API key identifies one Notify tenant and application, whose environment and scope list determine what the caller may do.

Create a key​

  1. Sign in to Notify Console with permission to manage application credentials.
  2. Open the tenant workspace and select the application.
  3. Open its credentials and choose Create API key.
  4. Use a descriptive name, such as example-app staging backend.
  5. Select scopes based on Scopes and permissions.
  6. Copy the returned secret immediately.

The full key is shown once. Notify stores a hash for verification and a prefix for identification. Credential lists do not reveal the original secret.

Use the key​

Authorization: Bearer APPLICATION_API_KEY

Keep it in backend configuration or a secret manager. Do not embed it in browser JavaScript, a mobile bundle, or a public repository.

The key is trusted across its application. It is not a substitute for per-user authorization in your backend.

If the key is lost​

Create a replacement key. Deploy the new secret to every backend instance, verify the required operations, and revoke the previous key. The old secret cannot be recovered from Console, Swagger, or the database.

The Admin API also offers a credential rotation endpoint for authorized platform automation. That operation replaces the credential; coordinate consumers before invoking it. Creating a separate replacement credential first allows a controlled overlap.

Separate workloads​

Use different keys when separate services need different permissions. For example, a notification sender may need only notifications:send, while a provisioning process needs accounts:manage and providers:manage.