API Keys

An API Key is for server endpoints that explicitly support Personal Access Tokens. It is not a universal credential for every API and is not used for MCP OAuth.

Create a Key

1. Open Portal → Personal Access Tokens.
2. Click New token, enter a name and select Read or Write as needed.
3. Click Create token and copy the arn_pat_… value. The plaintext is shown only once.

Store and inject the Key through your backend's secret manager. Never put it in a browser, source repository or URL. If lost, create a replacement; the old plaintext cannot be recovered. The interface has no Key editing or expiry-date setting.

Permission boundaries

Choose the minimum permissions required by the endpoint. Event writes require Write, access to the target brand, and a configured event connection with an allowed event type. Creating a Key does not create a billing contract.

Server events use:

POST /api/v1/billing-events/{website_install_id}
Authorization: Bearer <API_KEY>
Content-Type: application/json
webhook-id: <UUID>

The public arz_pub_… installation ID locates the connection. It does not replace the secret Key. Official token-management endpoints under /me use a Clerk login session; a Key cannot create another Key.

Rotate or revoke

Create a new Key, update your backend and verify requests. Then click Revoke for the old Key in the same token list. Subsequent requests using the old Key will be rejected.

Troubleshoot

Common event-endpoint responses:

• 401: the Key is missing, invalid or revoked.
• 403 insufficient_scope: Write is missing.
• 404: the connection is unavailable or the Key lacks brand access.
• 422 server_event_not_configured: the installation ID is measurement-only, without server events configured.
• 422 event_handle_not_allowed: the event type is not allowed.

202 means received and queued, not completed attribution or billing. See the API reference for more responses.