Authentication
Shortify v1 uses scoped API keys. Server routes use workspace Server API Keys, app-scoped analytics uses App API Keys, and client attribution routes use publishable client keys.
Keep secret keys on your server
Credential Types
Server API Key
Workspace secret key.
Use in the api-key header for links, deep links, domains, link analytics, and raw event export.
App API Key
Secret key for one configured deep-link app.
Use in the api-key header for /v1/analytics/deep-link-app. The app is resolved from the key.
Publishable Client Key
Scoped key for SDK and client attribution flows.
Use only with /v1/client/*. Keys are limited by workspace, environment, platform, and configured origin/package/bundle checks.
Headers
| Parameter | Type | Required | Description |
|---|---|---|---|
| api-key | string | Required | Workspace Server API Key or App API Key for server/app-scoped endpoints. |
| x-publishable-key | string | Optional | Publishable client key for /v1/client/* endpoints. Authorization: Bearer and publishable-key are also accepted. |
| x-shortify-environment | string | Optional | Optional client environment scope. When sent, it must match the publishable key. |
| x-shortify-platform | browser | android | ios | Optional | Optional client platform scope. When sent, it must match the publishable key. |
| x-android-package | string | Optional | Required only when the Android publishable key has a package restriction. |
| x-android-sha256-cert | string | Optional | Required only when the Android publishable key has certificate restrictions. |
| x-ios-bundle-id | string | Optional | Required only when the iOS publishable key has a bundle restriction. |
curl "https://api.shortify.com/v1/links" \
-H "api-key: sk_live_your_server_key"curl -X POST "https://api.shortify.com/v1/client/resolve" \
-H "x-publishable-key: pk_live_your_publishable_key" \
-H "x-shortify-platform: browser" \
-H "Origin: https://example.com" \
-H "Content-Type: application/json" \
--data '{"shortLink":"https://go.example.com/invite"}'Request IDs
Every v1 response includes requestId and the X-Request-Id response header. You may send your own x-request-id header to make server logs and customer logs easier to match.