How do I authenticate RevenueDot API requests?
Send every key as a bearer token: Authorization: Bearer <key>. Which key depends on the API:
| Credential | Looks like | Use it for | Keep it |
|---|---|---|---|
| Public app key | appl_..., goog_..., test_... |
SDK endpoints for that app | In your app. It is public by design |
| Secret key | sk_... |
REST API v1, REST API v2, extensions, and SDK endpoints from your backend | On your servers only |
| Dashboard session | cookie rd_session |
REST API v2 from the dashboard, for every project you belong to | In the browser |
| Pub/Sub push token | Google-signed JWT | Google Play notifications, when pubsub_audience is set |
Sent by Google |
| SCIM token (Enterprise) | rdscim_... |
The SCIM 2.0 service of one organization | In your identity provider |
Security schemes in the OpenAPI document#
publicApiKey: A public app key (appl_,mac_,goog_,test_,amzn_,strp_,rcb_,pdl_,roku_). Safe to ship in an app. The SDK sends it on every request.secretApiKey: A project secret key (sk_...). Server side only. Itspermissionslimit what it can do.dashboardSession: The dashboard session cookie fromPOST /auth/login. It authorizes/v2for every project the user belongs to.subscriberToken: A subscriber access token:rdat_...fromPOST /v2/projects/{project_id}/apps/{app_id}/authenticate, or the JWTaccess_tokenof an Auth sign-in (POST /v1/auth/login). It speaks for one app user id of one app for one hour. An expired or revoked token, or a path or body naming another app user id, answers 401 with code 7224.scimToken: RevenueDot Enterprise. A SCIM token (rdscim_and 64 hex characters) from Organization settings → SCIM provisioning orPOST /v2/organizations/{org_id}/scim/tokens. It speaks for one organization and works only on/scim/v2.importToken: An import token (rdi_and 64 hex characters) from Receive a project on the server a project moves to (POST /v2/imports/tokens). It lets one project move into the account that created it and lasts 24 hours.googlePubSubOidc: Google-signed OIDC token of a Pub/Sub push subscription. Checked only when the app'spubsub_audiencecredential is set.
Where keys come from#
- Public app key: created with the app. Read it with
GET /v2/projects/{project_id}/apps/{app_id}/public_api_keysor on the app's dashboard page. During a migration you can keep your RevenueCat key withPOST /v2/projects/{project_id}/import/apps/{app_id}/public_key. - Secret key:
POST /v2/projects/{project_id}/api_keysor the dashboard's API keys page. The key is shown once. RevenueDot stores only its SHA-256 hash. - OAuth for MCP clients: an MCP client can get a secret key through OAuth 2.1 with PKCE. The user picks one project and read or read-write access.
Permissions (secret keys)#
A secret key belongs to one project and holds a list of permissions. * allows everything. A read_write permission also allows read. A prefix wildcard such as customer_information:* allows every permission under it. Dashboard users with the viewer role get only read permissions. A key can only create keys with permissions it holds itself.
Permissions the operations use:
audiences:audiences:readaudiences:audiences:read_writecharts_metrics:charts:readcharts_metrics:charts:read_writecharts_metrics:overview:readcustomer_information:customers:readcustomer_information:customers:read_writecustomer_information:invoices:readcustomer_information:purchases:readcustomer_information:purchases:read_writecustomer_information:subscriptions:readcustomer_information:subscriptions:read_writeiam:authorization:issue_tokenproject_configuration:api_keys:readproject_configuration:api_keys:read_writeproject_configuration:apps:readproject_configuration:apps:read_writeproject_configuration:audit_logs:readproject_configuration:collaborators:readproject_configuration:discounts:readproject_configuration:discounts:read_writeproject_configuration:entitlements:readproject_configuration:entitlements:read_writeproject_configuration:integrations:readproject_configuration:integrations:read_writeproject_configuration:offerings:readproject_configuration:offerings:read_writeproject_configuration:packages:readproject_configuration:packages:read_writeproject_configuration:products:readproject_configuration:products:read_writeproject_configuration:projects:readproject_configuration:projects:read_writeproject_configuration:virtual_currencies:readproject_configuration:virtual_currencies:read_write
Each operation's section on the reference pages lists the permissions it needs. A missing permission answers 403 authorization_error and names it.
Common mistakes#
- A public key on REST API v2 answers 403: "API v2 requires a secret API key (sk_...)".
- A secret key in an app gives anyone who unpacks the app full access to your project. Delete it (
DELETE /v2/projects/{project_id}/api_keys/{key_id}) and create a new one. - Another project's id with a valid key answers 404, not 403, so ids cannot be probed.