Secret Keys
The backend-only key for AI generation, app users' files, anchor management and asset uploads.
A secret key is the API key that stays on your own backend. It starts with rv_secret_.
- It is the only key for AI generation, for your app users' files and for minting user tokens.
- It can list, edit and delete anchors, attach content to them and upload images, videos and 3D models.
- It reaches every project of the team, or one project if you bind it to one when you create it.
See Authentication for how it compares with a client key.
Never put a secret key in an app you publish, a web page, or anything else you ship.
Anyone who reads it there can do everything the key can do, including spending the team's AI credits and editing or deleting anchors. A published app holds a client key.
Create a secret key
- In your team's sidebar, under Integrations, click API Keys
- Click Create Key
- Enter a Key Name
- Under Key type, choose Secret key
- Optionally, under Project, choose one project. A bound secret key reaches only that project. Without one, the key reaches every project of the team.
- Set Expiration:
- for a key your backend uses, leave it at No expiration
- for a key an internal demo build will hold, set an expiry
- Click Create, then Copy Key
Studio shows a secret key once. Copy it when you create it and store it securely.
What only a secret key can do
- AI generation
- Reading and deleting your app users' files
- Minting user tokens (see User tokens)
- Listing, editing and deleting anchors
- Attaching content to anchors and removing it
- Uploading images, videos and 3D models with
rvUploadAsset(see Assets Storage)
A secret key can also call every client-key method. Its responses include every field and private anchors (isPublic: false), which client keys never see.
Cloud Anchors
These Cloud Anchors methods need a secret key:
rvListCloudAnchors(limit, offset)rvUpdateCloudAnchor(id, name, desc, isPublic)rvDeleteCloudAnchor(anchorId)rvAttachAssetToCloudAnchor(id, url, size, name, type, userId)rvRemoveAssetFromCloudAnchor(anchorId, assetId)
Geospatial Anchors
These Geospatial Anchors methods need a secret key:
rvListGeospatialAnchorsrvUpdateGeospatialAnchorrvDeleteGeospatialAnchor
Assets
rvUploadAsset needs a secret key. See Assets Storage.
Calling the API from your backend
Every operation is under the base URL:
https://platform.reactvision.xyz/functions/v1
Send the secret key in the x-api-key header. For example, to fetch a project:
curl https://platform.reactvision.xyz/functions/v1/projects/{project_id} \
-H "x-api-key: rv_secret_..."
A key of the wrong type for an operation is refused with 403 API_KEY_TYPE_NOT_ALLOWED. A bound key asked about another project's anchor, scene, file or task gets the same answer as if it did not exist. See Project binding.
In a published app, upload files and attach them to anchors from your backend, and host the anchor in the app.
Internal builds
For an internal demo with no backend, a build that only your team installs may hold a secret key as rvApiKey. Create a secret key with an expiry for it.
- The examples on Cloud Anchors that upload and attach assets run as written only this way.
- An internal build may also use a secret key for co-location.
- A published app never holds one. In a published app, the methods above fail with "This endpoint does not accept this type of API key".
If a secret key leaks
Delete it in Studio and create a new one. Deleting a secret key also revokes every user token minted with it.
To replace a key without a leak:
- Create the new key
- Move your servers to it
- Delete the old key
Legacy keys
A legacy key (rv_live_, made before Studio 1.5.0) can call every secret-key operation except:
- AI generation (a few listed keys keep it for a transitional period)
- listing, fetching and deleting app users' files
- minting user tokens
If your backend relies on a legacy key for operations a client key cannot call, create a secret key before the key's conversion date. See Legacy keys.
Next Steps
- Client Keys: the key that goes inside your app
- Authentication: project binding, user tokens, legacy keys and errors
- Assets Storage: uploading files with
rvUploadAsset
Updated about 2 hours ago