Messaging API authentication and security

important

This page is in beta. Features and documentation for the Messaging API are subject to change.

The Messaging API uses client-side REST API keys. These keys are distinct from the private REST API keys used for server-side Braze REST API requests.

Client-side REST API keys

Client-side REST API keys are scoped to one workspace and restricted to Messaging API permissions. You can embed these keys in client applications.

important

Use only a client-side REST API key in a client application. Never expose a private server-side REST API key in client-side code.

To create a client-side REST API key:

1. Go to Settings > APIs and Identifiers > API Keys in the Braze dashboard.
2. Select Create API Key.
3. For Key type, select Client.
4. Assign the banners.sync permission to retrieve Banners, the banners.track permission to report Banner events, or both.

Authenticating requests

Send the client-side REST API key as a bearer token in the Authorization header:

1
Authorization: Bearer {YOUR_CLIENT_SIDE_REST_API_KEY}

Use HTTPS and the REST endpoint for your Braze instance.

User identity

A client-side REST API key authenticates the calling application and workspace, not the user. The external_user_id in a request identifies the user associated with Banner content and events.

Apply your application’s authorization controls before making Messaging API requests.

Authentication errors

Authentication and permission failures can differ by endpoint. Refer to each endpoint’s status-code table and Messaging API error handling.