The Qonversion REST API v4 uses Bearer token authentication.
Secret Key
All v4 public endpoints require a Secret Key. Unlike v3, which mixed SDK-level access tokens with privileged server keys, v4 exposes only the server-to-server surface — so a single token type is used for every operation, from reads to privileged mutations (granting entitlements, managing products, experiment overrides, rotating credentials).
- Prefixed with
sk_
- Found in Project settings in the Qonversion dashboard
- Passed as
Authorization: Bearer sk_…
The Secret Key should only be stored on your server. Never use the Secret Key in Android, iOS, or web apps. Client apps authenticate through the Qonversion SDK, which uses a separate SDK-level token — not the public REST API v4.
Sandbox vs production
Use a test-prefixed token to target the sandbox environment:
The API behaves identically in both environments; data is isolated.
Error codes
See Handling Errors for the full error envelope.
Coming from v3?
In v3 some endpoints accepted a non-secret Project Key (SDK-level access token) — for example, reading users or creating purchases. In v4 those endpoints live only on the server-to-server surface and require a Secret Key. Client SDKs continue to use their own access token and do not call the v4 public API directly.