How API keys work
Keys start with rblr_, are shown exactly once, and can do only one thing: report your own store’s visit events.
What a key looks like
Every store gets its own API key: the prefix rblr_ followed by 48 random characters. The prefix makes a leaked key easy to recognize in code or logs, and easy to talk about with support.
Shown once, hashed forever
The raw key appears exactly once — in the amber panel right after it is created. From then on, Rebilder keeps only its sha-256 hash (a one-way fingerprint). That hash is what the Console displays as sha256: plus 8 characters on the Install and Settings pages, so you can always tell WHICH key is active without the key itself ever being retrievable — by you, by support, or by an attacker who breached the database.
What a key can and cannot do
- Can: authenticate event reporting — the gateway sends visit events to Rebilder’s
POST /v1/eventsendpoint with the key as a Bearer token, and those events fill your visit log. - Cannot: read any data, sign in to the Console, change settings, or touch your storefront. The key’s only scope is writing events.
- Cannot: write another store’s events. The store is always resolved from the key itself, never from the request body.