Device Messaging API authentication and security

The Device Messaging API uses client-side REST API keys. These keys are distinct from the private REST API keys used for server-side Braze REST API requests.

important

This page is in beta. Features and documentation for the Device Messaging API are subject to change. Contact your Braze account manager to request access.

Client-side REST API keys

Client-side REST API keys are scoped to one workspace and restricted to Device Messaging API permissions. You can embed these keys in client applications.

important

Use only a client-side REST API key in a client application. Never expose a private server-side REST API key in client-side code.

To create a client-side REST API key:

1. Go to Settings > APIs and Identifiers > API Keys in the Braze dashboard.
2. Select Create API Key.
3. For Key type, select Client.
4. Assign the banners.sync permission to retrieve Banners, the banners.track permission to report Banner events, or both.

Authenticating requests

Send the client-side REST API key as a bearer token in the Authorization header:

1
Authorization: Bearer {YOUR_CLIENT_SIDE_REST_API_KEY}

Use HTTPS and the REST endpoint for your Braze instance.

User identity

A client-side REST API key authenticates the calling application and workspace, not the user. The external_user_id in a request identifies the user associated with Banner content and events.

Apply your application’s authorization controls before making Device Messaging API requests.

Authentication errors

Authentication and permission failures can differ by endpoint. Refer to each endpoint’s status-code table and Device Messaging API error handling.