SATIK DEVELOPER DOCS · V1 BETA

Keys for your code. Google for you.

Dashboard sessions and API keys have separate responsibilities.

Secret API keys

Keep API keys on your server and send them as a Bearer token.

API key types and storage
Key or property	Behavior
Live key`sk_live_…`	Use for custom addresses and live verification.
Test key`sk_test_…`	Use documented fixtures. Test verification never calls Google or affects delivery history.
Authorization header`Authorization: Bearer <key>`	Send the complete secret key with each API request.
Secret storage	Keys contain 32 random bytes and are stored as SHA-256 hashes. Only the prefix remains visible after creation.

Rotation and revocation

Choose rotation when replacing a key, or revocation when access should stop.

Key lifecycle
Operation	Effect
Rotate a key	Creates a new secret. The old key remains valid for a 14-day grace period.
Revoke a key	Stops access immediately.
Audit record	Key changes are recorded in the workspace audit log.

Google-only sign-in

Dashboard access uses a verified Supabase Google session. Server-side membership records determine tenant access; user-editable profile metadata never grants permissions.