Authentication

API requests use bearer tokens in the Authorization header. Use an API key for resource operations such as events, attendees, and tickets. Webhook administration requires a dashboard access token instead.

Using your API key

Set EVENTLAYER_KEY in your server environment. new Eventlayer() reads it automatically at construction time and handles the Authorization header:

EVENTLAYER_KEY=sk_your_key_here

You can also pass a key explicitly with new Eventlayer("sk_your_key_here"), or add configuration as the second argument: new Eventlayer("sk_your_key_here", { timeout: 10_000 }). An explicit key overrides the environment variable. To use the environment key with configuration, pass undefined first: new Eventlayer(undefined, { maxRetries: 0 }). Keep the key on the server, out of browser bundles. In runtimes without process.env, pass it explicitly.

import { Eventlayer } from "eventlayer";

const eventlayer = new Eventlayer();

// All subsequent calls are authenticated
const { data: events, error: eventsError } = await eventlayer.events.list();
if (eventsError) throw eventsError;

For raw HTTP requests, include the key as a bearer token:

curl https://api.eventlayer.dev/v1/event \
  -H "Authorization: Bearer $EVENTLAYER_KEY"

Dashboard access tokens

Webhook endpoint management, delivery inspection, replay, and signing-secret rotation require a short-lived dashboard access token from an authenticated, email-verified user session. An API key cannot authorize these operations.

Pass a callback as the SDK's accessToken option to resolve a current bearer token for each request. The SDK does not handle sign-in or token refresh itself. For ordinary dashboard use, sign in and open Webhooks; the dashboard manages its session tokens automatically.

See Webhooks for delivery history and endpoint management.

Token format

API tokens follow the format {public_id}-{raw_token}:

• The public_id is the API key's identifier (e.g. sk_35d400aab1a52a2f).
• The raw_token is the secret portion used for authentication.

The server stores a blake3 hash of your token. The raw token is never persisted.

Next steps