Keys and roles
Secret keys, public keys, sessions, and what each organization role may do.
Send Authorization: Bearer <credential> with every request.
| Credential | Use | Can do |
|---|---|---|
Secret key sd_sk_… |
Servers, agents, CI | Everything in one project |
Public key sd_pk_… |
Shipped in client apps | Read offerings, check a user's entitlements, submit App Store and Google Play receipts, attach an anonymous user to a signed-in one, set (not read) customer attributes |
| Session | People (salesdogg login, the dashboard) |
Projects of their organizations, according to their role. Project-scoped endpoints need an X-Project-Id header. |
A public key can be extracted from any app, so it never returns a customer's attributes or purchase history, and it cannot link a Stripe or Braintree subscription by id (that id is not proof of purchase; use a secret key, or attribute the purchase at checkout).
Keys
npx -y @salesdogg/cli api-keys list
npx -y @salesdogg/cli api-keys create --kind secret --name ci
npx -y @salesdogg/cli api-keys revoke <api_key_id>
A secret key is shown once, when it is created. Keep it in your environment or a secret manager, never in an app or a repository.
Organization roles
Roles apply to signed-in people. Owners and admins can do everything. Members can view and operate (catalog, customers, grants, simulator) but cannot create or revoke API keys, connect, change or remove providers, add or remove webhook endpoints, delete customers, or create or delete projects. A secret key carries its project's full authority regardless of who created it.
Rate limits
600 requests a minute per secret key or user, and 120 per client address for public keys. Responses carry RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset; a 429 includes Retry-After. Provider webhooks are never limited.