Skip to main content
Every request to the Peeng ingestion API must include an API key in the x-api-key request header. There is no OAuth flow, no bearer token exchange, and no request signing — the key itself is the credential, and it is all you need.
Treat your API key like a password. Never commit it to source control, never embed it in client-side or browser-executed code, and never include it in a mobile app bundle — anyone who obtains the key can write logs to your project. Store it as an environment variable on your server and read it at runtime.

​
Creating a key

Keys are created per-project from the Peeng dashboard. Navigate to Settings → API Keys and click New API Key. Peeng stores only a hash of the key, so the full key value is displayed exactly once — at the moment of creation. Copy it immediately and store it somewhere safe. If you lose it, you must regenerate it rather than retrieve it.

​
Test vs. live keys

Every key has a scope — either test or live — reflected in its prefix:
Both scopes hit the same API endpoint and behave identically at the protocol level. The scope exists so you can distinguish your own test traffic from real production traffic at a glance — in the key list, in audit logs, and alongside the environment field you set in each log entry. Use a test-scoped key from local development and staging environments, and a live-scoped key from production.
The test / live key scope is independent of the environment field you include in each log body. You control both separately — key scope for visibility in the dashboard, and environment for filtering and grouping your own logs.

​
Regenerating a key

If a key is compromised or lost, regenerate it from Settings → API Keys in the Peeng dashboard. Regeneration is atomic — the old key stops working the instant the new one is issued. There is no grace period where both keys are valid simultaneously.
Update every service that uses the old key before you regenerate it, or those services will begin failing requests immediately when the old key is invalidated.

​
Missing or invalid keys

Any request that omits the x-api-key header, or provides a key that does not match an active key for your project, receives a 401 response:
See Errors for the full error envelope shape and a complete list of error codes.