Restricted keys

Restricted keys are additional credentials you create for a specific integration. They use the pf_rk_ prefix, require a human-readable name, and carry an explicit scope list. Under the hood each Restricted key is still either Public-capped or Secret-powered.

• A vendor or microservice should send push but must not manage subscribers.
• A mobile CI job needs Public-level identity actions without access to your main Secret.
• You want to revoke one integration without rotating the project Secret.

The console loads allowed scopes from PushFire for the key type you select. If the type is Public, the server rejects any attempt to grant send or workflow scopes. That rule cannot be bypassed from the UI or the API.

Secret-type Restricted keys may include server actions you choose at creation time. Scopes are fixed until you revoke the key and create a replacement.

1. Open Developers → API keys → Restricted keys.
2. Create a key: name (required), Public or Secret type, scopes.
3. Copy the plaintext from the one-time modal.
4. Revoke when the integration is retired or compromised.

API keys overview · Public and Secret keys