Authentication
Growth Rail uses two different credentials depending on where your code runs. The client-side SDK uses a Project Secret, while server-to-server REST API calls use an API Key.
Credentials Overview
| Credential | Prefix | Header | Where to use |
|---|---|---|---|
| Project Secret | sk_ | X-GrowthRail-ProjectSecret | Client-side SDK only (@growth-rail/react, @growth-rail/core) |
| API Key | Server-to-server (Public REST API) | Authorization: Bearer | grak_ |
Project Secret
The Project Secret is a publishable key that identifies your project from the client. Pass it during SDK initialization and the SDK attaches it to every request via the X-GrowthRail-ProjectSecret header.
X-GrowthRail-ProjectSecret: sk_a1b2c3d4e5f6g7h8...
Because it ships inside your client bundle, the Project Secret is not a private credential. Instead, Growth Rail validates the Origin header against your project's Allowed Origins list. Requests from unlisted domains are rejected with 401 Unauthorized.
API Keys
API Keys (prefixed grak_) are used for server-to-server REST API calls. Create and manage them in the dashboard under Organisation → API Keys. Include the key in the Authorization header using the Bearer scheme.
Authorization: Bearer grak_your_api_key_here
Generate and manage API keys in the dashboard under Organisation Settings. You can create keys with custom expiry (30 days, 90 days, 1 year, no expiry, or custom date) and revoke them at any time.