Authentication
Use the right credential for the job. Every request stays scoped to a workspace.
Two kinds of access
| Credential | Used for | Where to get it |
|---|---|---|
| Developer API key | POST /api/v1/developer/events | Channels / Developer API |
| Dashboard session | Managing API keys, webhook endpoints and delivery history | Sign in to the dashboard |
Developer API keys
Authorization: Bearer YOUR_API_KEYKeys begin with pb_live_ and belong to one workspace. Pingback stores their hashes and displays each secret once. Revoking a key immediately prevents new requests using it.
Workspace permissions
Members can view the workspace's developer configuration. Owners and admins can create or revoke keys and add or disable webhook endpoints. The Developer API requires an active Scale plan.
Rotate a secret
Create a replacement key, update your server configuration, verify a request, then revoke the old key. For a webhook secret, add a replacement endpoint and disable the old endpoint after switching your receiver.