# Authentication

Source: https://pushary.com/docs/web-push/server-sdk/authentication
Last updated: 2026-05-11

> Understanding Pushary's authentication system

## Two-Tier Authentication [#two-tier-authentication]

Pushary uses a two-tier authentication system for security:

### Site Key (Client-Side) [#site-key-client-side]

* **Format:** `pk_xxxxxxxxxxxxxxxx`
* **Use:** Client SDK in browser
* **Security:** Public, domain-validated
* **Rate limit:** Based on plan

```typescript
import { createPushary } from '@pushary/sdk'

createPushary({
  siteKey: 'pk_abc123def456',
})
```

### Full API Key (Server-Side) [#full-api-key-server-side]

* **Format:** `pk_xxxxxxxxxxxxxxxx.sk_xxxxxxxxxxxxxxxx`
* **Use:** Server SDK and API calls
* **Security:** Secret, never expose in browser
* **Rate limit:** Higher limits for server-to-server

```typescript
import { createPusharyServer } from '@pushary/server'

createPusharyServer({
  apiKey: 'pk_abc123def456.sk_secret789xyz',
})
```

## Key Generation [#key-generation]

When you create a site, you receive:

1. **Site Key** - The `pk_xxx` portion, displayed in dashboard
2. **Full API Key** - The `pk_xxx.sk_xxx` combination, shown only once

If you lose your full API key, you'll need to regenerate it from the dashboard.

## Security Best Practices [#security-best-practices]

### Do [#do]

* Store API keys in environment variables
* Use the server SDK only in backend code
* Rotate keys if compromised
* Use different API keys for development/production

### Don't [#dont]

* Expose full API key in client-side code
* Commit API keys to version control
* Share API keys in public channels
* Use API keys in browser-bundled code

## HTTP Authentication [#http-authentication]

When making direct API calls, use Bearer authentication:

```bash
curl -X POST https://pushary.com/api/v1/server/send \
  -H "Authorization: Bearer pk_xxx.sk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"title": "Hello", "body": "World"}'
```

## Domain Validation [#domain-validation]

The Site Key is validated against your registered domain. This prevents unauthorized usage of your key on other websites.

Localhost domains are allowed during development.