Skip to main content
The Qonversion REST API v4 uses Bearer token authentication.

​
Secret Key

All v4 public endpoints require a Secret Key. Unlike v3, which mixed SDK-level access tokens with privileged server keys, v4 exposes only the server-to-server surface — so a single token type is used for every operation, from reads to privileged mutations (granting entitlements, managing products, experiment overrides, rotating credentials).
The Secret Key should only be stored on your server. Never use the Secret Key in Android, iOS, or web apps. Client apps authenticate through the Qonversion SDK, which uses a separate SDK-level token — not the public REST API v4.

​
How to work with sandbox data

Use your Secret Key exactly as shown in the dashboard: Authorization: Bearer sk_YOUR_SECRET_KEY. Endpoints that support sandbox data take an explicit environment value. For example, creating a user accepts prod or sandbox, and scheduled reports use production or sandbox. Analytics, customers, and screen and experiment analytics endpoints take a numeric environment query parameter: 0 for sandbox, 1 for production.

​
Error codes

See Handling Errors for the full error envelope.

​
Coming from v3?

In v3 some endpoints accepted a non-secret Project Key (SDK-level access token) — for example, reading users or creating purchases. In v4 those endpoints live only on the server-to-server surface and require a Secret Key. Client SDKs continue to use their own access token and do not call the v4 public API directly.