Authentication & API Keys

The Hober REST API base URL is https://api.hober.io. Every request is authenticated with one of three credential types, each scoped to what that kind of caller should be able to do.

Credential types at a glance

Credential	Format	Sent as	Secrecy	Typical caller
Client SDK key	sk_…	X-SDK-Key header	Publishable	Mobile / browser SDKs embedded in your app
Server key	hober_srv_…	Authorization: Bearer	Secret	Your backend (event tracking, export, REST hooks)
Dashboard session token	JWT	Authorization: Bearer	Secret, short-lived	The Hober dashboard on behalf of a logged-in user

Client SDK key

The client SDK key is a publishable, workspace-scoped key designed to be shipped inside mobile apps and web pages. Its format is a sk_ prefix, an encoded workspace identifier, and an HMAC-SHA256 signature:

sk_XXXXXXXXXXXXXXXX.YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY

The signature is embedded in the key itself — requests are not individually signed. Send the key verbatim on every request:

X-SDK-Key: YOUR_SDK_KEY

You can copy your workspace's SDK key from the dashboard under Settings → API keys. The key is stable for the life of the workspace: the same key is returned every time you view it, and there is currently no self-serve rotation.

What the client key can call

Because the key is extractable from a shipped app, it only grants write-forward, device-facing operations:

• POST /api/v1/subscribers/upsert — create or update a subscriber
• POST /api/v1/devices — register a device push token
• POST /api/v1/notifications/interactions — record opens, taps, and clicks
• POST /v1/events and POST /v1/events/identify — behavioral event ingestion (client tier — see Events for tier limits)
• The in-app message delivery stream used by the SDKs

It cannot read or export data, send notifications, or manage any workspace resource. A missing or invalid key returns 401 with code UNAUTHORIZED.

Server keys

Server keys are secret, revocable credentials for server-to-server calls. Their format is the hober_srv_ prefix followed by 32 URL-safe base64 characters. Send them as a bearer token:

Authorization: Bearer hober_srv_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Create and revoke server keys in the dashboard under Settings → API keys (requires a role with credential-management permission). The full key is shown exactly once at creation — only its prefix is displayed afterwards, and the key is stored as a one-way hash.

Scopes

Each server key carries a set of scopes with the shape domain:read / domain:write. Keys created without explicit scopes get the default set:

Scope	Grants
events:write	Event ingestion (POST /v1/events, /v1/events/identify) — the default scope

A server key that reaches the events endpoint without events:write receives 403 with code FORBIDDEN.

What server keys can call

• POST /v1/events, POST /v1/events/identify — server-tier event ingestion, including external_id actor resolution and larger batch limits
• GET /v1/events/export — bulk event history export
• GET /v1/whoami — the identity of the presented key
• POST /v1/hooks, GET /v1/hooks, DELETE /v1/hooks/:id — REST hook (webhook subscription) management, as used by the Zapier integration
• GET /v1/subscribers — a paged subscriber listing for integrations

See the Server-Side Event Tracking guide for choosing between the client and server tier.

Revocation

Revoking a key takes effect immediately for most surfaces; the event ingestion path caches successful validations briefly, so a revoked key can keep ingesting for up to about one minute.

Dashboard session tokens

Management surfaces — notifications, campaigns, templates, schedules, segments, journeys, channels, webhooks, team, and billing — are authenticated with the short-lived JWT bearer tokens that the dashboard obtains when a user logs in. Access tokens expire after 15 minutes and are refreshed transparently by the dashboard session; role-based permissions on the logged-in user additionally gate what each token may do (for example, read-only tokens receive 403 with code READ_ONLY_TOKEN on write requests).

There is currently no long-lived personal access token for the management API. For programmatic server-to-server access, use a server key (events, export, and REST hooks) — or agent access over MCP, which uses its own hober_mcp_ key type; see the Agent access guide.