11

Authentication

To use the SDK, you’ll need to get two kinds of keys: A CDP API Key to send data to Customer.io and a Site ID that tells the SDK which workspace your messages come from.

Get your CDP API Key

You’ll use your write key to initialize the SDK and send data to Customer.io; you’ll get this key from your mobile app’s data sourceA source is a website or server that you want to capture data from—it’s a source of data! in Customer.io. If you don’t already have a mobile data source, you’ll need to set one up.

1. Go to the Data Pipelines tab.
2. On the Connections page under Sources, select your Flutter source. If there is no Flutter source, you’ll need to set up a new data source.

   

   
3. Go to Settings and find your CDP API Key. Copy this key into your initialization call. If you’re upgrading from a previous version of the SDK, you should set the siteId that you used in previous versions as the migrationSiteId in your config.

   

   

   CustomerIO.initialize(
      config: CustomerIOConfig(
         cdpApiKey: '<your CDP API Key>',
         //migrationSiteId is required if you're updating from a previous version
         migrationSiteId: '<your siteId>', 
         region: Region.us,
         autoTrackDeviceAttributes: true,
         inAppConfig: InAppConfig(siteId: '<your siteId>'),
      ),
   );

Set up a new source

If you don’t already have a write key, you’ll need to set up a new data sourceA source is a website or server that you want to capture data from—it’s a source of data!. The source represents your app and the stream of data that you’ll send to Customer.io.

1. Go to the Data Pipelines tab. On the Connections page under Sources, click Add Source.
2. Select the Mobile: Flutter source and then click Next: Connect Flutter.

   

   
3. Enter a Name for the source, like “My Flutter App”.
4. We’ll present you with a code sample containing a cdpApiKey that you’ll use to initialize the SDK. Copy this key and keep it handy.
5. Test your connect and click Complete Setup. Or, if you don’t want to test your implementation yet, Save & Complete Later and then click Install Source to finish the setup process. In this case, Complete Later simply means that we haven’t seen any data from your Flutter app yet.

   

   

Now the Connections page shows that your Flutter source is connected to your Journeys workspace. Hover over a source or destination to see its active connections. You can also connect your Flutter source to additional destinations if you want to send your mobile data to additional services—like your analytics provider, data warehouse, or CRM.

Get your Site ID

You’ll use your Site ID to send in-app messages from your workspace.

If you’re upgrading from a previous version, my can also set your Site ID as your migrationSiteId. This key is used to send remaining tasks to Customer.io when your audience updates your app.

1. Go to and select Workspace Settings in the upper-right corner of the Customer.io app and go to API and Webhook Credentials.

2. Copy the Site ID for the set of credentials that you want to send your in-app messages from. If you don’t have a set of credentials, click Create Tracking API Key.

   

   

3. You’ll use this key to initialize the inApp package. If you’re upgrading from a previous version, you’ll also use it as your migrationSiteId.

   CustomerIO.initialize(
      config: CustomerIOConfig(
         cdpApiKey: '<your API Key>',
         //required if you're updating from a previous version
         migrationSiteId: '<your siteId>', 
         region: Region.us,
         autoTrackDeviceAttributes: true,
         inAppConfig: InAppConfig(siteId: '<your siteId>'),
      ),
   );

Securing your credentials

To simplify things, code samples in our documentation sometimes show API keys directly in your code. But you don’t have to hard-code your keys in your app. You can use environment variables, management tools that handle secrets, or other methods to keep your keys secure if you’re concerned about security.

To be clear, the keys that you’ll use to initialize the SDK don’t provide read access to data in Customer.io; they only write data to Customer.io. A bad actor who found your credentials can’t use your keys to read data from our servers.