API guide
Authenticate from your server
Use a key for one workspace
Send Authorization: Bearer YOUR_KEY on every request. bd_test_ keys access test data; bd_live_ keys access live data. Each key belongs to one workspace. OAuth access tokens use the same header.
Give each integration only the scopes it needs. A read-only key cannot send messages or change subscribers. Owners and admins manage keys in the developer dashboard.
Store and rotate secrets
Store keys in a server-side secret manager or environment variable. Never prefix a secret with NEXT_PUBLIC_ or include it in client code. The raw key is shown once.
Roll a key to create a replacement while allowing a short overlap. Deploy the replacement, verify requests, then revoke the old key. If a key leaks, revoke it immediately and inspect request logs.