API

API tokens

Two token types, one rule: never let a secret leak. Public keys go in the browser; API tokens stay server-side, period.

The two types

	Public ingest key	API token
Prefix	`pk_`	`tk_live_`
Safe in browser?	Yes	No
Can write events?	To one property	Only if it has `event.write` capability
Can read stats?	No	Yes (with `property.read` capability)
Can manage?	No	Yes (with relevant capabilities + scope)
Storage at Tracera	Plaintext (it's public)	Argon2 hash — we cannot show it again

Scopes

An API token is bound to a single scope:

platform — touches everything (only platform owners can issue these).
tenant — all brands & properties within one tenant.
brand — all properties within one brand.
property — one property (most common for embedded dashboards).

Capabilities

Tokens carry an explicit list of capabilities. The default is "the bare minimum the role needs"; you can narrow further at issue time:

// Capabilities reference
property.read
property.write
event.write
export.read
user.invite
user.remove
role.assign
billing.manage
token.create
token.revoke
whitelabel.write
domain.write

Rotation

Tokens can be rotated without downtime: create a new one, deploy it, revoke the old one.

Expiry

Tokens can be created with an explicit expires_at. We strongly recommend a maximum 12 months.

Revoking a leaked token

Portal → API tokens → the token row → Revoke.
Audit-log entries for the token are retained per the platform's audit retention policy.