API keys

API keys allow your applications to interact with CloudSignal services programmatically. Use them for server-side operations, automation, and integrations.

API keys are not the same as MQTT credentials:

Type	Used for
API key	CloudSignal REST API and service endpoints
MQTT credential	MQTT broker connections (see Clients)

Guides

Key types

Understand publishable vs secret keys

Managing keys

Create, rotate, and revoke API keys

Quick overview

CloudSignal provides two types of API keys:

Key type	Prefix	Use case	Security
Publishable	`pk_`	Client-side code, browser apps	Limited permissions, safe to expose
Secret	`sk_`	Server-side code only	Full permissions, never expose

When to use API keys

Publishable keys (`pk_`)

Context	Example
Web applications	React, Vue, Angular
Mobile apps	iOS, Android
Client-side code	Browser-based scripts
Public API calls with limited scope	Token exchange initiation

Secret keys (`sk_`)

Context	Example
Server-side applications	Node.js, Python, Go
Automation scripts	Background jobs
CI/CD pipelines	Deployment workflows
Admin operations	Org-wide management calls

Never expose secret keys in client-side code, version control, or public repositories.

Common use cases

Token exchange

Use API keys to exchange external identity provider tokens (Supabase, Firebase, Auth0) for MQTT credentials:

// Server-side only - uses secret key
const response = await fetch('https://api.cloudsignal.io/v2/tokens/exchange', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${process.env.CLOUDSIGNAL_SK}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    provider: 'supabase',
    token: supabaseAccessToken,
  }),
});

const { mqtt_username, mqtt_password } = await response.json();

REST bridge publishing

Publish MQTT messages via HTTP using the REST bridge:

// Can use a publishable key for client-side publishing
const response = await fetch('https://rest-publisher.cloudsignal.app/publish', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${publishableKey}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    topic: 'agents/agent-01/state',
    payload: { status: 'idle', load: 0.12 },
  }),
});

Next steps

Understand key types - When to use each key
Manage your keys - Create and rotate keys
Set up auth providers - Use keys for token exchange

Key types

Managing keys

On this page