API keys

Your workspace has a single API key, under Settings, API & Webhooks. The card explains what it is for: "Use these to query your guide data from your own code."

The key exists ahead of the endpoints it will be used with, so you can put it into your secret store now and be ready when the API opens.

The live key

• Access "Full read/write access"

• Display Masked, shown as sk_live_•••• •••• •••• ••••

• Actions Copy and Rotate

Copy puts the full key on your clipboard. Rotate issues a new key and invalidates the old one.

Coming soon. The public API is on the roadmap and the card is labelled "Public API coming soon". There are no endpoints to call yet, so the key does not do anything today beyond existing. To get data out right now, use Export all data under Settings, Danger zone, which downloads guides, analytics, and feedback as CSV.

Keeping it safe

This key has full read and write access to your workspace, so treat it the way you treat a database password.

Server side only. Use it from your backend, a serverless function, or a scheduled job. Never from a browser, a mobile app, or anything else a user can open.

Never in client code. It must not appear in front-end JavaScript, in an HTML page, or in a public bundle. This is a different key from the one in your pixel snippet, which is a publishable key designed to be visible in the browser. See Pixel reference for the distinction.

Never in a repo. Keep it in environment variables or a secrets manager, not in source control, not in a config file you commit, and not in a screenshot pasted into a ticket.

Heads up. If the key leaks, or you think it might have, rotate it. Rotating invalidates the old key immediately, so anything still using it stops working. Update every service that holds the key as part of the same change.

Webhooks

Coming soon. The Webhooks section of the same settings page is marked COMING SOON. The app states the plan directly: "Webhook endpoints for guide.started, guide.completed, step.skipped, and guide.rated are on the roadmap." There is nowhere to register an endpoint yet. Events covers what those four events mean.

Who can manage this

Managing the API key is an Admin job. Roles in Reveal today are Admin and Member, and the app describes them as "Admin can manage workspace & billing · Member can create and edit guides". If you cannot see or rotate the key, ask an Admin in your workspace, or ask them to change your role under Settings, Team.

Next steps

• Events: The four named events and what they mean.

• Team and roles: Admin and Member, and how to invite people.

• Danger zone: Export all data and the irreversible actions.

• Pixel reference: The publishable key that belongs in the browser.