API keys

Create and manage secret and publishable API keys to authenticate server-side calls and client SDKs.

API keys authenticate your integrations with EngageApp. Create and manage them under Settings → API keys. There are two kinds, each with its own purpose and header.

Secret keys

Secret keys (df_…) authenticate your server-side calls — importing contacts, ingesting events, and enrolling contacts. Send them as the X-API-Key header:

X-API-Key: df_your_secret_key

Never expose a secret key in client code. Keep it on your server or in a secrets manager.

Publishable keys

Publishable keys (pk_…) are safe to embed in your app. The client SDKs use them for in-app takeovers. Send them as the X-Publishable-Key header:

X-Publishable-Key: pk_your_publishable_key

Copying, rotating & revoking

The full plaintext key is shown only once, when you create it — copy it then and store it securely. If you lose it, create a new key rather than trying to recover the old one. You can rotate or revoke keys at any time from Settings → API keys.

Next steps

Related

Server-side integration guide

Connect EngageApp to your backend with a secret API key — sync contacts, track events, and enroll contacts into campaigns.

Public API reference

The public HTTP API for server-side and SDK integrations — authentication headers and endpoints.

Web SDK reference

API reference for @engageapp/inapp-web — init, identify, onAppForeground, setHandlers, and dismiss.

In-App Takeover setup

Integrate the EngageApp SDK (Web or Flutter) so full-screen in-app takeover campaigns render natively when your users open your app.