Authentication & API keys
Every application has two kinds of key, each in a test and a live version.
| Key | Looks like | Where it goes | Secret? |
|---|---|---|---|
| Publishable | pk_test_… / pk_live_… | Embed code, JavaScript SDK, HTML pages | No — safe to show |
| Secret | sk_test_… / sk_live_… | Your server only (REST API) | Yes — shown once |
Test vs live
- Test keys never consume credits, work on your allowed domains and
localhost, show a TEST MODE label, and are limited to 200 sessions per application per day. - Live keys consume credits and only work after you press Go live, on your allowed domains.
- Test and live data (scores, usage, leaderboards) are kept separate.
Using a secret key
Send it in the Authorization header. Keys in the URL are rejected so they never end up in logs.
curl https://play.acbizglobal.net/api/v1/games -H "Authorization: Bearer sk_live_YOUR_SECRET_KEY"
Scopes
By default a secret key can do everything. When creating extra keys you can restrict them:
games:read | Read the game catalog |
games:launch | Create signed launch URLs |
usage:read | Read usage & analytics |
credits:read | Read credit balance & ledger |
scores:read | Read scores & leaderboards |
webhooks:manage | Manage webhooks |
application:read | Read application details |
Rotation, expiry and revocation
- Rotate issues a new key. The old key can keep working for a grace period (1 hour – 7 days) so you can deploy the new one without downtime.
- Expiry — extra secret keys can be created with a 30/90/180/365-day lifetime.
- Revoke stops a key immediately. Revoking the last publishable key of an environment automatically issues a fresh one.
- We only store a SHA-256 fingerprint of secret keys. If you lose one, rotate it.
Rate limits
Each secret key has a per-minute limit based on your plan (Standard: 120/min by default). Every response includes X-RateLimit-Limit and X-RateLimit-Remaining; over the limit you get 429 with a Retry-After header.