API keys

PushFire API authentication no longer uses a single project Bearer token for every call. Projects now use scoped API keys: a Public key for device/subscriber identity, a Secret key for server-to-server actions, and optional Restricted keys with a custom scope set.

If your project still shows a Legacy credential, that key keeps existing integrations working while you adopt Public and Secret keys. Revoke the legacy key only after you have validated the new setup.

• Public key: Prefix pf_pk_. Safe for SDKs and end-user apps. Registers and updates devices, subscribers, and subscriber tags. Cannot send push, send email, or start workflow executions.
• Secret key: Prefix pf_sk_. Backend only. Can send push/email, create workflow executions, and other server actions allowed by its scopes. Never ship this value in a mobile app or browser bundle.
• Restricted key: Prefix pf_rk_. Created by you with a name and a subset of scopes. Still Public-capped or Secret-powered according to its key type. Use for least-privilege integrations.
• Legacy key: Pre-migration credential. Authenticated without pf_* prefix rules and without the scoped Public/Secret model. Deprecated. Keep it only until Public and Secret are wired and tested, then revoke it.

In the PushFire Console open Developers → API keys. Platform keys (Public and Secret) support Rotate. Restricted keys support Create and Revoke. The plaintext secret is shown once after create or rotate—copy it immediately.

Read Public and Secret keys for platform keys, rotation, and storage.

Read Restricted keys for custom scopes and naming.

Read Legacy credentials and migration if you still have a legacy key.

For HTTP endpoints and payloads, see the API Reference.