API keys

Every request carries one key in the Authorization: Bearer <key> header. The key decides the environment and what the request may do.

Key types

Key	Prefix (test / live)	Where it lives	Can do
Publishable	pf_pub_test_ / pf_pub_live_	Inside your app	Register and remove its own device, nothing else
Secret	pf_sk_test_ / pf_sk_live_	Your server	Everything in its environment
Restricted	pf_rk_test_ / pf_rk_live_	An agent, a CI job, a teammate’s script	Only the scopes you pick

Publishable keys are safe to ship in an app. Keep secret and restricted keys on servers and in secret stores.

Scopes

A restricted key gets none, read or write for each resource. Write includes read.

Resource	Read lets the key	Write lets the key
messages	Look up messages and their delivery status	Send, send batches and send tests
devices	List users’ devices	Register and remove devices, delete users
templates	Read templates	Create, change and delete templates
credentials	See which credentials are connected	Upload Apple and Firebase credentials
keys	List keys	Create and revoke keys
webhooks	List webhook endpoints	Add, change and remove endpoints

A restricted key can never create a key with more access than it has itself, so an agent with keys: write and messages: write can’t mint a key that uploads credentials.

Identity verification

A publishable key ships inside your app, so anyone can find it. Without a check, someone could register their own phone under another person’s user ID and receive that person’s notifications.

So in live mode, registering a device requires a userToken: a short-lived token your server signs with its secret key for the signed-in user. The SDK signs it locally, with no request to PushFleet:

TypeScriptPythonGoRustRuby

TypeScript

const userToken = fleet.users.token("user_8f3k");

Python

user_token = fleet.users.token("user_8f3k")

Go

userToken := fleet.Users.Token("user_8f3k")

Rust

let user_token = fleet.users().token("user_8f3k")?;

Ruby

user_token = fleet.users.token("user_8f3k")

Your app passes it along when it registers:

SwiftKotlinFlutterReact Native

Swift

PushFleet.register(deviceToken: token, userId: "user_8f3k", userToken: userToken)

Kotlin

PushFleet.register(fcmToken = token, userId = "user_8f3k", userToken = userToken)

Flutter

await PushFleet.register(userId: "user_8f3k", userToken: userToken);

React Native

await PushFleet.register({ userId: "user_8f3k", userToken });

Test mode accepts registrations without a user token, so you can try PushFleet before your server is involved.