API keys & authentication

Open your organization workspace
Open API keys, give your key a name and select Create API key. An organization owner or administrator can help if you don't have access.
Keep the default permissions
These let your integration submit reviews (reviews:write), retrieve reports (reviews:read) and check remaining allowance (usage:read). Permissions, also called scopes, limit what a key can do. You don't need any extra permissions for the review examples.
Save your key once
Copy the secret when it is shown. Replace YOUR_API_KEY in the terminal command with that secret, then run it before the examples. This saves it as STELETTA_API_KEY for that terminal session. Keep keys on your server, never in browser code or a public repository.

Why are some keys labelled test?

Test and live are credential labels, not different review modes. Separate keys let you revoke a development integration without replacing the key used by your production app. Both run real reviews against the same organization allowance; a test key is not a free sandbox.

Terminal · set your key

export STELETTA_API_KEY="YOUR_API_KEY"

Include in every authenticated request

Authorization: Bearer YOUR_API_KEY