How API keys work
Keys start with rblr_, are shown exactly once, and can do only one thing: report your own store’s visit events.
What a key looks like
Every store gets its own API key: the prefix rblr_ followed by 48 random characters. The prefix makes a leaked key easy to recognize in code or logs, and easy to talk about with support.
Shown once, hashed forever
The raw key appears exactly once, in the amber panel right after it is created. From then on, Rebilder keeps only its sha-256 hash (a one-way fingerprint). That hash is what the Console displays as sha256: plus 8 characters on the Install and Settings pages, so you can always tell WHICH key is active without the key itself ever being retrievable, whether by you, by support, or by an attacker who breached the database.
What a key can and cannot do
- Can: authenticate event reporting. The gateway sends visit events to Rebilder’s
POST /v1/eventsendpoint with the key as a Bearer token, and those events fill your visit log. - Cannot: read any data, sign in to the Console, change settings, or touch your storefront. The key’s only scope is writing events.
- Cannot: write another store’s events. The store is always resolved from the key itself, never from the request body.