API Authentication
Authenticate requests to the Logspot API with your project's public or secret key.
Every request to the Logspot API is authenticated with a project key passed in a header. There are two keys, and which one you use depends on where your code runs.
Find Your Keys
In the Logspot dashboard, go to Project Settings → Integrations. The Project Key section at the top of the page shows both:
- Public Key, prefixed
pk_. Safe to include in client-side code. - Secret Key, prefixed
sk_. Server-side only. Never expose it in a browser, a mobile app, or a public repository.
Each project has its own pair of keys.
Authenticate a Request
Send the key as the header value, including its pk_ or sk_ prefix. The prefix is part of the key and
the API will reject the request without it.
Server-side, using the secret key:
curl https://api.logspot.io/track \
-H "Content-Type: application/json" \
-H "x-logspot-sk: sk_a1b2c3d4e5f6" \
-d '{"name": "Signup Completed", "user_id": "user_123"}'Client-side, using the public key:
curl https://api.logspot.io/track \
-H "Content-Type: application/json" \
-H "x-logspot-pk: pk_a1b2c3d4e5f6" \
-d '{"name": "Page Viewed"}'No Bearer scheme is needed. Pass the key on its own, the way the snippets in Project Settings show
it.
Which Key to Use
| Endpoint | Public key | Secret key |
|---|---|---|
/track, /identify, /group, /consent | Yes | Yes |
/search-events | No | Yes |
/analytics/* | No | Yes |
/embed/ott | No | Yes |
Requests made with the public key are rate limited per IP address. Requests made with the secret key are rate limited per key.
If a request returns a 401, check that the header value still carries its pk_ or sk_ prefix, that
the endpoint accepts the key type you used, and that the key belongs to the project you are writing to.