Authentication

Every /v1 request uses an organization secret key:

Authorization: Bearer sk_test_…

Use sk_test_ keys for development and sk_live_ keys for production. Keys are scoped to one organization and an explicit set of capabilities.

Server only

Never place a Smore key in:

• Browser JavaScript or mobile application bundles
• An iframe URL
• Logs, analytics, traces, or exception metadata
• Git, issue trackers, or agent prompts

Load it from your server’s secret manager:

const apiKey = process.env.SMORE_SECRET_KEY;

if (!apiKey) throw new Error("SMORE_SECRET_KEY is required");

Your authorization remains authoritative

Authenticate the caller on every partner-owned endpoint. Load the mapped Smore scene, operation, or package ID from the authorized server-side record.

Do not accept a Smore resource ID from the browser and use it as authorization. Smore also hides cross-organization resources behind the same 404 not_found response used for unknown IDs.

Protect sensitive responses

Any partner response containing a Smore resource, operation result, signed URL, or embed URL should include:

Cache-Control: private, no-store

Preserve Smore’s safe response status, body, Retry-After, and requestId so failures remain diagnosable without exposing internal details.

Rotate without browser changes

Keys belong only to backend configuration, so rotation does not require a frontend release. Create a replacement key, update the secret manager, verify traffic, then revoke the old key.