PUSH API · v1a
Authentication and keys
Public API authentication uses the Authorization: Bearer header over HTTPS. Never put credential values in URLs, logs, screenshots or support requests.
| Credential | Where it belongs | Allowed purpose |
|---|---|---|
pk_test_… / pk_live_… | App SDK configuration | Public key. Enrolls installations with installations:enroll. Cannot send messages or rebind users. |
sk_test_… / sk_live_… | Secret storage on your trusted backend | Server key. Performs only granted operations. Never embed it in an app, browser or public documentation. |
gsk_test_… / gsk_live_… | Secret storage on your trusted backend | Unified sending key. POST /v1/project-messages submits to 2–8 selected apps in one project environment. Existing app and SDK keys stay unchanged. Never embed this key in an app. |
it_… | Device storage managed by the SDK | Secret installation token returned by enrollment. Allows supported self-device mutations only, not access to other installations. |
| FCM/APNs credentials | Operator-managed push service connection | Push service authentication secrets. Different from Kits public/server keys; never place them in the SDK. |
| Dashboard login session | Dashboard browser | For human administration. Not a substitute for a server key or an SDK API origin. |
Match the key to its environment
- An app key and its target installation must belong to the same app environment. A unified sending key can reach only its explicitly selected apps in one project environment.
- Use messages:send for a test send and messages:read to inspect results. Grant only the permissions needed.
- Customer SDKs use https://kits-api.marco-corp.com exclusively, with no URL or HTTP opt-in setting. The API origin in curl examples is not an SDK initialization option.
- The SDK manages storage for new managed integrations. Only apps maintaining the legacy core examples below retain their exact existing storageNamespace through the compatibility path. Do not rename or delete storage when rotating keys or updating the app.
Check permissions
Each API reference lists accepted credential types and required permissions. Alternatives separated by OR do not all have to be satisfied at once.
View per-operation permissions