How do I authenticate RevenueDot API requests?
Send every key as a bearer token: Authorization: Bearer <key>. Which key depends on the API:
| Credential | Looks like | Use it for | Keep it |
|---|---|---|---|
| Public app key | appl_..., goog_..., test_... |
SDK endpoints for that app | In your app. It is public by design |
| Secret key | sk_... |
REST API v1, REST API v2, extensions, and SDK endpoints from your backend | On your servers only |
| Dashboard session | cookie rd_session |
REST API v2 from the dashboard, for every project you belong to | In the browser |
| Pub/Sub push token | Google-signed JWT | Google Play notifications, when pubsub_audience is set |
Sent by Google |
Security schemes in the OpenAPI document#
publicApiKey: A public app key (appl_,mac_,goog_,test_,amzn_,strp_,rcb_,pdl_,roku_). Safe to ship in an app. The SDK sends it on every request.secretApiKey: A project secret key (sk_...). Server side only. Itspermissionslimit what it can do.dashboardSession: The dashboard session cookie fromPOST /auth/login. It authorizes/v2for every project the user belongs to.googlePubSubOidc: Google-signed OIDC token of a Pub/Sub push subscription. Checked only when the app'spubsub_audiencecredential is set.
Where keys come from#
- Public app key: created with the app. Read it with
GET /v2/projects/{project_id}/apps/{app_id}/public_api_keysor on the app's dashboard page. During a migration you can keep your RevenueCat key withPOST /v2/projects/{project_id}/import/apps/{app_id}/public_key. - Secret key:
POST /v2/projects/{project_id}/api_keysor the dashboard's API keys page. The key is shown once. RevenueDot stores only its SHA-256 hash. - OAuth for MCP clients: an MCP client can get a secret key through OAuth 2.1 with PKCE. The user picks one project and read or read-write access.
Permissions (secret keys)#
A secret key belongs to one project and holds a list of permissions. * allows everything. A read_write permission also allows read. A prefix wildcard such as customer_information:* allows every permission under it. Dashboard users with the viewer role get only read permissions. A key can only create keys with permissions it holds itself.
Permissions the operations use:
charts_metrics:overview:readcustomer_information:customers:readcustomer_information:customers:read_writecustomer_information:purchases:readcustomer_information:purchases:read_writecustomer_information:subscriptions:readcustomer_information:subscriptions:read_writeproject_configuration:api_keys:readproject_configuration:api_keys:read_writeproject_configuration:apps:readproject_configuration:apps:read_writeproject_configuration:collaborators:readproject_configuration:entitlements:readproject_configuration:entitlements:read_writeproject_configuration:integrations:readproject_configuration:integrations:read_writeproject_configuration:offerings:readproject_configuration:offerings:read_writeproject_configuration:packages:readproject_configuration:packages:read_writeproject_configuration:products:readproject_configuration:products:read_writeproject_configuration:projects:readproject_configuration:projects:read_write
Each operation's section on the reference pages lists the permissions it needs. A missing permission answers 403 authorization_error and names it.
Common mistakes#
- A public key on REST API v2 answers 403: "API v2 requires a secret API key (sk_...)".
- A secret key in an app gives anyone who unpacks the app full access to your project. Delete it (
DELETE /v2/projects/{project_id}/api_keys/{key_id}) and create a new one. - Another project's id with a valid key answers 404, not 403, so ids cannot be probed.