Authentication

Every request to https://api.botsi.com carries one of your app's API keys in the Authorization header. Every V2 endpoint accepts either the secret key or the public key, sent the same way. Find the secret key on the App configuration page in the dashboard at https://app.botsi.com.

Authorization: {{secret_key}}
Content-Type: application/json

Send the key raw, with no scheme prefix

There is no Bearer and no Api-Key prefix. The header value is the key itself.

Adding a prefix is the most common cause of an authentication failure that looks like a wrong key.

Choosing a key#

The public key ships inside your app, so it's the one to use from a mobile client. Use the secret key from your servers.

Never embed the secret key in your app

Anyone who unpacks your app binary can read a key shipped inside it. Keep the secret key on your servers, and use the public key from a mobile client.

The examples across these docs send $BOTSI_SECRET_KEY. Swap in your public key when you make the same call from your app.

Making an example authenticated request#

curl -X POST "https://api.botsi.com/v2/events" \
  -H "Authorization: $BOTSI_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "eventType": "paywall_shown",
    "paywallSessionId": "v1.eyJhIjo0MDIxLCJ3Ijo5MDUsInAiOiJvbmJvYXJkaW5nIiwiaSI6MTc4NTMxMjAwMH0.QmzR1w"
  }'

Troubleshooting#

A 401 Unauthorized means no valid key was provided. Check the key matches your App configuration page exactly, and that no scheme prefix was added. The response body is:

{ "error": "No valid API key provided.", "code": "unauthorized" }

A 403 Forbidden means the key is valid but lacks permission for that resource.