Authentication

Learn how to authenticate your requests to the Pullbay API using Bearer tokens. This guide covers getting your API key, implementing authentication in multiple languages, managing key security, and rotating keys safely.

Getting Your API Key

Every Pullbay API request requires authentication with an API key.

1

Sign in

Sign in to your Pullbay Dashboard

2

Open API Keys

Navigate to API Keys in the left sidebar

3

Create a key

Click Create New Key and give it a name (e.g. "Production", "Development")

4

Copy the key

Copy the key

Never share your API keys. Treat them like passwords.

How to Authenticate

Every request to the Pullbay API must include your API key in the Authorization header using the Bearer scheme:

Authorization: Bearer YOUR_API_KEY

cURL

curl "https://api.pullbay.com/appstore/reviews?appId=284882215&maxItems=5" \
  -H "Authorization: Bearer YOUR_API_KEY"

Python

import requests
import os

api_key = os.environ["PULLBAY_API_KEY"]

response = requests.get(
    "https://api.pullbay.com/appstore/reviews",
    params={"appId": "284882215", "maxItems": 5},
    headers={"Authorization": f"Bearer {api_key}"},
    timeout=30,
)
print(response.json())

Node.js (Axios)

const axios = require('axios');

const apiKey = process.env.PULLBAY_API_KEY;

const response = await axios.get(
  'https://api.pullbay.com/appstore/reviews',
  {
    params: { appId: '284882215', maxItems: 5 },
    headers: { 'Authorization': `Bearer ${apiKey}` },
  }
);

console.log(response.data);

Node.js (Fetch)

const apiKey = process.env.PULLBAY_API_KEY;

const params = new URLSearchParams({ appId: '284882215', maxItems: '5' });
const response = await fetch(
  `https://api.pullbay.com/appstore/reviews?${params}`,
  {
    method: 'GET',
    headers: { 'Authorization': `Bearer ${apiKey}` },
  }
);

const data = await response.json();
console.log(data);

PHP

<?php
$apiKey = getenv('PULLBAY_API_KEY');
$url    = 'https://api.pullbay.com/appstore/reviews?appId=284882215&maxItems=5';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Authorization: Bearer ' . $apiKey,
]);

$response = curl_exec($ch);
$data     = json_decode($response, true);
print_r($data);

Go

package main

import (
    "fmt"
    "io"
    "net/http"
    "os"
)

func main() {
    apiKey := os.Getenv("PULLBAY_API_KEY")
    url    := "https://api.pullbay.com/appstore/reviews?appId=284882215&maxItems=5"

    req, _ := http.NewRequest("GET", url, nil)
    req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", apiKey))

    client := &http.Client{}
    resp, _ := client.Do(req)
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}

Authentication Errors

A failed authentication returns 401 Unauthorized:

{
  "requestId": "3b8dcb68-1f8c-4a7b-b9e7-63a7b9986f24",
  "status": 401,
  "message": "Unauthorized",
  "success": false,
  "error": { "code": "AUTHENTICATION_UNAUTHORIZED" }
}

Cause	Solution
Missing Authorization header	Add Authorization: Bearer YOUR_API_KEY to every request
Wrong header format	Must be Authorization: Bearer YOUR_KEY — capital B, space after "Bearer"
API key revoked	Generate a new key in the dashboard and update your application
API key not yet active	Wait a few seconds after creation and retry

Failed requests — including 401 — do not consume credits.

API Key Management

Creating a Key

1

Go to API Keys

Go to dashboard.pullbay.com → API Keys

2

Create a key

Click Create New Key

3

Name the key

Add a descriptive name (e.g. "Mobile App", "Analytics Dashboard", "n8n Workflow")

4

Copy it

Click Create and copy the key immediately

Rotating a Key Safely (Zero Downtime)

1

Create a new key

Create a new key alongside the old one — both work at the same time

2

Update applications

Update all applications to use the new key; test in staging first

3

Deploy and verify

Deploy the changes to all instances and verify requests are succeeding with the new key

4

Revoke the old key

Revoke the old key once you're confident nothing still uses it — this invalidates it immediately

Revoking a Key

1

Open API Keys

Go to API Keys in the dashboard

2

Find the key

Find the key you want to revoke

3

Revoke it

Click the three-dot menu → Revoke

4

Confirm

Confirm — the key is invalidated immediately

Any application still using the revoked key will begin receiving 401 responses. Update your code before revoking.

Viewing Key Usage

Go to API Keys, select a key, and view its activity log:

• Total requests made with this key

• Requests by endpoint

• Requests by date

• Credits consumed

Security Best Practices

Storage

• Use environment variables — never hardcode a key in source code

• Use a secrets manager in production (AWS Secrets Manager, Google Secret Manager, HashiCorp Vault)

• Add .env files to .gitignore — keys committed to version control are exposed even if later removed

import os
api_key = os.environ["PULLBAY_API_KEY"]  # Correct — read from environment
api_key = "abc123..."                    # Never do this

Access

• One key per application — use separate keys for your mobile app, backend service, n8n workflow, and so on

• Keep live keys out of development — use a key scoped to your development environment for local testing

• Rotate every 90 days or whenever team membership changes

• Revoke unused keys promptly — unused keys are attack surface

What Not to Do

• Don't commit keys to Git — even if you remove them later, they remain in commit history

• Don't include keys in client-side code — browser JavaScript is readable to anyone

• Don't share keys via email, Slack, or chat — use a password manager or secrets manager

• Don't log keys — make sure debug output and log files never capture the Authorization header

Common Questions

Can I have multiple API keys?

Yes — create as many keys as you need. Common patterns:

• One key per application (mobile app, backend service, automation workflow)

• One key per environment (development, staging, production)

• One key per team member for individual usage tracking

Each key is independently revocable without affecting the others.

How do I rotate a key without downtime?

Create a new key first, update all applications to use it, verify everything works, then revoke the old key. Both keys are valid simultaneously during the transition so there is no gap in service.

What should I do if my API key is compromised?

Act immediately:

1. Revoke the compromised key from the dashboard

2. Create a new key

3. Update all applications and redeploy

4. Review recent usage in the dashboard for any suspicious requests made while the key was exposed

Can I restrict what endpoints a key can access?

Yes, you can restrict your API keys on a per-endpoint basis.