Public and private API keys for Customer.io APIs

Now you don't have to juggle site IDs, Track API keys, and App API keys to use our APIs. Now, you generate a key based on where your code runs: a public key for browsers and mobile apps, or a private key for your servers. One private key works with every Customer.io API, so a server integration doesn't need different sets of credentials for different purposes.

• Public keys start with pk_. Use one in code that runs in a browser or mobile app. A public key can identify people, send events, and handle in-app messages, but it can’t send messages directly or read your data, so it’s safe to include in your app.
• Private keys start with sk_. Use one in code that runs on your server. A private key works with all our APIs, including sensitive operations like sending messages, deleting people, and reading your data.

Our SDKs and server-side libraries are set up to use these new keys, but you don’t need to change anything you do today. Your existing credentials will continue to work.