Authentication
The REST API authenticates with a per-environment API key, sent as a bearer token.
API keys
Every environment has its own API key. Send it in the Authorization header on every request:
text
Authorization: Bearer <YOUR_ENVIRONMENT_API_KEY>Because keys are scoped to an environment, the key you use decides which integrations, templates and rules apply, and keeps test traffic separate from production. Treat keys as secrets: store them in environment variables, never in client-side code or version control.
The dashboard and widget
- Team members sign in to the app with magic links, no passwords.
- The embeddable chat widget authenticates visitors with its own short-lived visitor token, so you never expose an API key in the browser.
If a key is ever exposed, rotate it from the
Environments page. Sends already in flight are unaffected.