API keys

Snow’s server-side APIs need a key so the collector knows the request really came from you. A single API key authenticates every one of them: the Server-side events API, the Identify API, and AI-crawler reporting.

Treat API keys like passwords. They grant write access to your site’s data, so keep them server-side, never commit them to source control, and never put them in front-end code or the tracking snippet.

Creating a key

Create an API key in your site’s settings. Each key:

belongs to one site and is shown in the format snw_live_….
carries the scopes you tick under What this key may do — Events (events:write), Identify (identify:write) and AI crawlers (bots:write). All three are on by default, so one key is the whole server-side story: one secret, one SNOW_API_KEY, one thing to rotate.
can be narrowed by unticking. The case that earns it is a key pasted into a CDN edge worker for crawler reporting: that key lives outside your app’s secret store, so giving it only bots:write means a leak cannot write revenue events. For a key that stays in your own backend environment, the default is fine.
is shown in full only once, right after you create it. Copy it and store it somewhere safe (a secrets manager or environment variable). Snow never shows it again; afterwards you only see a short prefix so you can tell keys apart.

You can create as many keys as you want (handy for separate services, or for rotating without downtime) and revoke any of them at any time. Revoking takes effect immediately and can’t be undone; a revoked key stops working at once.

You can also mint the key from Settings → Tracking, next to whichever snippet you are reading — server events, identify, or AI crawlers. It is the same key, and creating it there fills it into all of them at once, so the secret never has to travel between screens.

Using a key

Send the key as a Bearer token in the Authorization header:


Authorization: Bearer snw_live_your_key

See each API’s reference for the full request format:

Server-side events API →Identify API →

Legacy identify keys

Earlier versions used a separate, single-purpose identify key (format ski_…) only for the Identify API. Those keys still work, so existing integrations keep running, but new setups don’t need one: use a single snw_live_ API key for everything.

Crawler reporting briefly wanted a second key of its own for the same reason — bots:write used to be withheld from the default scopes. It no longer is, and keys minted before that change were granted the scope, so an existing SNOW_API_KEY works for crawler reporting without being rotated.