Keys and authentication
Calls send Authorization: Bearer <key>, except where a page is registered to work without one.
| Key | Where it lives | What it may call |
|---|---|---|
Publishable, pk_live_… |
In your pages (it isn't a secret) | Sessions and seat resolution, from the domains registered for it |
Secret, sk_live_… |
On your server only, never in a page or an app | Sessions with no Origin (headless), and your own keys and venues under /manage |
| None (keyless) | — | Sessions from a domain we've registered for you; the browser's Origin is the proof |
pk_test_… and sk_test_… keys are for our development environment only and are refused in production.
Publishable keys and origins
A publishable key works only when the request's Origin is one of its allowed origins: an exact scheme, host and port, or a leftmost wildcard such as https://*.example.com. Anything else is 403 origin_not_allowed. Origins must be https://. Very broad origins (a public suffix, a shared hosting domain, an origin many sites share) aren't accepted.
Keyless works the same way without a key: we register your exact booking origins, and each origin belongs to one partner. It's how most ticketing-platform scripts run, since there's nowhere to keep a key.
Embed keys additionally list the domains allowed to frame the hosted view; the browser enforces it with Content-Security-Policy: frame-ancestors.
Secret keys and server sessions
A server holding a secret key may create a session with no Origin header (a server session: native apps send none). Only secret keys of the same partner, again with no Origin, can use it after that. Its creating response carries eventsToken (shown once), which your server hands to the app with the sessionId for events. A secret key sent with an Origin is held to its allowed origins like a publishable key.
With a secret key you can also manage your own keys and venues: create, rotate and revoke keys, and read and update your venue records. See the API reference.
Rotating and revoking
- Rotate (
POST /manage/keys/{keyId}/rotate, withgraceSecondsup to 7 days, default 24 hours) issues a replacement with the same settings; the old key keeps working until the grace ends. - Revoke (
DELETE /manage/keys/{keyId}) stops a key within a minute. Signed image URLs already issued still expire on their own, within 30 minutes. - If a secret key has been seen anywhere it shouldn't be, revoke it at once (or rotate with no grace).
Rate limits
Limits are per one-minute window; over one, the API answers 429 rate_limited with Retry-After (the seconds left).
| Limit | Counts | Default |
|---|---|---|
| Per secret key | every request with the key | 20,000 a minute |
| Per publishable or keyless key | session creation only | 20,000 a minute |
| Per publishable or keyless key and client IP | session creation only | 300 a minute |
| Per browser or keyless session | seat resolution and the manifest together | 120 a minute |
| Per session | event batches | 120 a minute |
Server sessions have no per-session limit; the key's limit bounds them.