API keys

API keys authenticate server-to-server calls into Pulse. Each key is scoped to specific operations, tied to one workspace, and revocable.

Key format

pk_1a2b3c4d5e6f7g8h...

The pk_ prefix identifies it as a Pulse key. The full value is shown once when created and cannot be retrieved afterward — store it securely.

Scopes

Scope	Grants
`track:write`	POST events and identify calls.
`track:read`	Read back recently ingested events.
`customers:read`	List / fetch customer records.
`customers:write`	Upsert customers and their attributes.
`events:read`	Query the events explorer API.
`campaigns:read`	List campaigns and read their stats.

Creating a key

Go to Integrations → API keys → + New key.
Pick a name and check the scopes you need.
Optionally set an expiry date.
Copy the value immediately — you won't see it again.

Rotating a key

Create a new key with the same scopes, deploy it to your systems, confirm traffic on the new key, then revoke the old one. Keys cannot be edited in place.

Revoking

Click Revoke next to any key. Revocation is immediate; subsequent requests return HTTP 401.

Never commit API keys to source control. Store them in a secrets manager (AWS Secrets Manager, HashiCorp Vault, Doppler, 1Password, etc.) and inject via environment variables.