Authentication
WysLeap has two kinds of key, both in Site Settings.
- Secret keys (
wl_sk_…) authenticate your servers onPOST /api/v1/events. Send them asAuthorization: Bearer wl_sk_…. They're shown once when created; keep them in your server's environment and revoke any that leak. - The site API key identifies your site to the browser tracker on the
/api/telemetryendpoints. It ships in your tracker snippet, so it isn't a secret: the endpoints also check the page's domain against your allowed domains. Supply it as a header or in the body.
Secret key
Authorization: Bearer wl_sk_…Site API key
X-API-Key: your-api-key-hereSecurity
Never put a secret key in client-side code or a public repo. From a server, always use a secret key and /api/v1/events rather than the site API key.