Customer.io
GitHub project

Authentication

To use the SDK, you need a public API key (beginning with pk_) to send data to Customer.io. If you upgrade from an earlier SDK version, or use in-app messaging with an SDK version before 5.1.0, you also need your Site ID.

Which key goes in your app

Your app uses a public key, which starts with pk_. Public keys are safe to include in your app. Private keys start with sk_ and have much broader access to your workspace, so keep them in your backend systems where your users can’t get to them. See public and private keys.

Get your public key

You’ll use a public key, which starts with pk_ and is shown in code samples as cdpApiKey, to initialize the SDK and send data to Customer.io. You’ll get this key when you set up your mobile app as a data in integration in Customer.io, or you can create one for an existing integration on the API Credentials page. If you haven’t already set up your integration in Customer.io, you’ll need to do that first.

  1. Go to Integrations.
  2. Select your Flutter integration in the Overview tab. If you don’t see a Flutter integration, you’ll need to set it up.
    the connections page, showing an Flutter source connected to a journeys destination
  3. Go to Settings and find your public key. It starts with pk_. Copy this key into your initialization call. If you’re upgrading from a previous version of the SDK, you should set the siteId that you used in previous versions as the migrationSiteId in your config.
    The API keys section of your integration's Settings tab, showing your public key
    DART
    CustomerIO.initialize(
   config: CustomerIOConfig(
      cdpApiKey: '<your CDP API Key>',
      //migrationSiteId is required if you're updating from a previous version
      migrationSiteId: '<your siteId>', 
      region: Region.us, // Replace with Region.EU if your Customer.io account is in the EU.
      autoTrackDeviceAttributes: true,
      inAppConfig: InAppConfig(),
   ),
);

Upgrading from an earlier SDK version?

You still need your Site ID to support people updating your app from a previous version of the Customer.io SDK. If you use an SDK version before 5.1.0, you also need it for InAppConfig. See Get your Site ID below.

Set up a new integration

If you don’t already have a public key, you’ll need to set up a new data in integration in Customer.io. The “integration” represents your app and the stream of data that you’ll send to Customer.io.

  1. Go to Integrations and click Add integration.
  2. Select Flutter.
    set up your Flutter integration
  3. Enter a Name for your integration, like “My Flutter App”.
  4. Click the Copy and paste code tab. The code sample includes your public key (beginning with pk_) as cdpApiKey. Copy this key and keep it handy; you’ll need it to initialize the SDK.
    The integration setup screen, with a name for your integration and a code sample that includes your public key
  5. Click Test connection to check that Customer.io receives data from your app, and then click Complete setup. If you aren’t ready to test your app yet, click Save for later.

Remember, you can also connect your Flutter app to services outside of Customer.io—like your analytics provider, data warehouse, or CRM.

Get your Site ID

If you’re upgrading from a previous version of the SDK, you set your Site ID as your migrationSiteId. The SDK uses it to send remaining tasks to Customer.io when your audience updates your app.

If you use an SDK version before 5.1.0, you also need your Site ID for InAppConfig. In 5.1.0 and later, the SDK uses your public key for in-app messages, so you can leave the Site ID out of InAppConfig().

  1. Go to and select Workspace Settings in the upper-right corner of the Customer.io app and go to API and Webhook Credentials.

  2. Copy the Site ID for the set of credentials that you want to send your in-app messages from. If you don’t have a set of credentials, click Create Tracking API Key.

    find your site ID

  3. Set this key as your migrationSiteId. If you use an SDK version before 5.1.0, also pass it to InAppConfig.

    DART
    CustomerIO.initialize(
   config: CustomerIOConfig(
      cdpApiKey: '<your API Key>',
      //required if you're updating from a previous version
      migrationSiteId: '<your siteId>', 
      region: Region.us, // Replace with Region.EU if your Customer.io account is in the EU.
      autoTrackDeviceAttributes: true,
      inAppConfig: InAppConfig(siteId: '<your siteId>'),
   ),
);

Securing your credentials

To simplify things, code samples in our documentation sometimes show API keys directly in your code. But you don’t have to hard-code your keys in your app. You can use environment variables, management tools that handle secrets, or other methods to keep your keys secure if you’re concerned about security.

To be clear, the keys that you’ll use to initialize the SDK don’t provide read access to data in Customer.io; they only write data to Customer.io. A bad actor who found your credentials can’t use your keys to read data from our servers.

Updated October 30, 2026