Authentication and Project Keys
Which credential goes where, and why the project secret never ships in an app
IForevents has two project credentials. Where the code runs decides which one it may hold.
| Credential | Header | Where it lives | What it can do |
|---|---|---|---|
| Project key | X-Project-Key | apps, browsers, SDKs | write events to one project (POST /v1/events/*) |
| Project secret | X-Project-Secret (with the key) | your servers only | read that project's analytics from scripts |
The key is public by design: anyone can pull it out of an app bundle, and all they gain is the ability to send events to your project. The secret is shown once, at project creation or rotation, and is stored hashed.
Client code: key only
Every SDK and snippet takes the key and nothing else:
curl -X POST https://api.iforevents.com/v1/events/track \
-H "X-Project-Key: <project key>" \
-H "Content-Type: application/json" \
-d '{"event_name":"purchase_completed","properties":{"amount":"99.99"}}'<script src="https://api.iforevents.com/sdk/v1/iforevents.min.js" async data-project-key="<project key>"></script>IForeventsAPIIntegration(config: IForeventsAPIConfig(projectKey: '<project key>'))config.api_key["projectKey"] = os.environ["IFOREVENTS_PROJECT_KEY"]The secret never ships
Server side only
X-Project-Secret belongs on your servers. No SDK takes it: the Flutter package, the browser SDK and every snippet the dashboard shows carry the key alone, and the ingest routes ignore the secret. Sending it from a browser, a mobile app or any code you ship to users publishes it.
If a secret ever ended up in a build or a repository:
- Rotate it from Settings → Project (or
POST /v1/projects/{uuid}/secret/rotate). A secret that shipped is public; rotating it invalidates every copy. - Keep analytics reads server side, where the new secret can live in an environment variable.
Server side: reading analytics
Scripts and backends read a project's analytics with the key and the secret, or with an organization-level API token (ifmcp_…, see API keys and credentials):
curl https://api.iforevents.com/v1/analytics/metrics \
-H "X-Project-Key: $IFOREVENTS_PROJECT_KEY" \
-H "X-Project-Secret: $IFOREVENTS_PROJECT_SECRET"The pair is read-only and pinned to that one project; it never grants project management, team or billing routes. Keep both values in environment variables or a secrets manager, never in version control.
Dashboard sessions
The dashboard and its proxies authenticate with a session issued by the accounts service (Authorization: Bearer …); MCP clients use OAuth or an API token. Neither involves the project secret.