API authentication

Engage uses separate credentials for mobile bootstrap, SDK sessions, and trusted server calls.

Credential classes

The app key is publishable. The other credentials are secrets.

Create an access key

In the console, open an environment and REST API:

1. choose a descriptive label such as orders-production;
2. select only the apps this service may target;
3. optionally set an expiration;
4. create the key and copy the plaintext secret immediately.

Engage stores a hash plus masked metadata and cannot show the secret again. Key statuses are active, expired, or revoked. Last-used timestamps support audits and rotation.

Send the bearer token

Authorization: Bearer engk_REDACTED

The environment ID in the URL must match the key’s environment. App-scoped operations are also restricted to allowedAppIds configured on that key.

Secret handling

• Store access keys in a managed secret store.
• Inject them at runtime; do not bake them into images or binaries.
• Redact request headers in logs and traces.
• Use one key per service/environment so it can be revoked independently.
• Rotate before expiration and after any suspected disclosure.
• Never send a key to a browser or mobile app.

App key safety

An app key selects an Engage app during installation bootstrap. Treat it like a publishable API identifier: avoid accidental cross-environment use, but do not design security around hiding it. Server operations require a separate access key.

Installation credentials

The SDK receives opaque installation, revocation, and recovery credentials during bootstrap and persists them in platform-owned storage. Application code should not read, export, or synchronize these values itself.