Authentication

Simplr uses API keys for client/server integrations and bearer tokens for portal management operations.

API Key Types

Key Type	Prefix	Usage	Environment
Live Secret Key	sk_live_	Production API calls from your server	Production
Test Secret Key	sk_test_	Testing in sandbox mode	Development
Live Public Key	pk_live_	Browser/mobile SDK ingestion and flag reads	Production
Test Public Key	pk_test_	Browser/mobile SDK testing	Development

Using API Keys

Include your API key in the X-API-Key header:

curl -X POST https://api.simplr-ai.com/v1/check \
  -H "Content-Type: application/json" \
  -H "X-API-Key: sk_live_xxxxxxxxxxxxx" \
  -d '{"email": "user@example.com"}'

Never Expose Secret Keys

• Do not include API keys in client-side code
• Do not commit keys to version control
• Use environment variables to store keys

Managing API Keys

Create a Key

1. Go to Dashboard > API Keys
2. Click Create API Key
3. Give it a descriptive name
4. Copy the key immediately (it won't be shown again)

Roll or revoke a key

If you suspect a key has been compromised:

1. Go to API Keys in your dashboard
2. Roll an active secret key to revoke it and receive a replacement once, or revoke it without replacement
3. Update the application immediately; the previous key has no overlap window

Revoke a Key

1. Go to API Keys in your dashboard
2. Revoke the key
3. Confirm the action

Key Deletion is Immediate

Revoked keys stop working immediately. Make sure no production systems are using the key.

Environment Variables

Store your API keys in environment variables:

# .env (never commit this file!)
SIMPLR_API_KEY=sk_live_xxxxxxxxxxxxx

Access in your code:

// Node.js
const apiKey = process.env.SIMPLR_API_KEY;

# Python
import os
api_key = os.environ['SIMPLR_API_KEY']

Rate Limits

Rate limits are currently set by endpoint class rather than by plan or daily quota. See Rate Limits for the enforced values and response headers.