API Authentication

Streakfox APIs use a mix of project identifiers and signed tokens depending on the endpoint.

Project ID (siteKey)

Public endpoints like /v1/e and /v1/state use your project ID (siteKey) in the request body or query string. Requests from the browser are validated against your Allowed Origins list.

Admin token (server-only)

Use the admin token when calling privileged routes like /admin/alias.

POST /admin/alias HTTP/1.1
Host: api.streakfox.com
X-Admin-Token: <ADMIN_TOKEN>
Content-Type: application/json

Only send the admin token from server environments (API routes, server actions, or backend services).

Alias tokens (browser-friendly)

To link anonymous visitors from the browser, generate a short-lived alias token on your server using the ALIAS_SIGNING_SECRET, then send it to /v1/alias.

The Quickstart guide includes a full token example in Node.