API Keys

API Keys authenticate requests to Sentinel's HTTP API — every API interaction requires one, including the widget fetching a challenge. Each key is created under a Security Group and inherits that group's access level and rules.

Key and secret

A key has two parts:

• The key itself — a public identifier in the form key_.... This is what the widget uses in its challenge URL (?apiKey=key_...).
• The secret — a cryptographic value used to verify requests, configurable (and rotatable) after the key is created. See Server Integration for how your server uses it to verify submissions.

Configuration settings

• Name — a descriptive label (e.g. a project or website name) to identify the key.
• Security Group — determines the key's permissions and access rules; see Security Groups.
• Secret — the cryptographic verification value, configurable after the key is created.
• Request Logs — logging level for requests made with this key: verification endpoints only, all requests, or disabled (which also disables analytics for the key).

Usage, by access level

Always include your API key on every HTTP API request. How you send it depends on the key's Security Group access level.

Public and Restricted access

Either form works, and both behave the same way:

• As a URL parameter: ?apiKey=key_...
• As a header: Authorization: Bearer key_...

This is what the widget uses — challenge="https://sentinel.example.com/v1/challenge?apiKey=key_...". Never attach the secret to a Public or Restricted request; only the key itself is meant to be client-side.

Full access (administrative)

Full-access endpoints require HTTP Basic authentication instead, combining the key ID and secret:

Authorization: Basic ${base64(apiKeyId + ':' + apiKeySecret)}

curl https://sentinel.example.com/v1/some-admin-endpoint \
  -u "key_...:your-secret"

Because this sends the secret on every request, only call Full-access endpoints from a trusted backend — never from the browser.

Related

• Security Groups — where a key's access level and rules come from.
• Widget Integration — using a Public key in the widget's challenge attribute.
• Server Integration — using the secret to verify submissions server-side.