Authentication

​

Header format

Authorization: Bearer ib_pk_<64 hex chars>

Authorization: Bearer ib_pk_a3f2c8d9e0f1b4d52c8a1f4e23b9d4f7ca8e51d2c3b4a5e6f7a8b9c0d1e2f3a4

​

Generating a key

1. Open your dashboard at ibubbl-dashboard.vercel.app.
2. Navigate to Settings → API Access.
3. Click Create key and give it a descriptive name (e.g., “production-backend”, “zapier-integration”).
4. Copy the key from the modal that appears. This is the only time the full secret is shown. If you lose it, revoke the key and create a new one.

​

Make an authenticated request

export IBUBBL_API_KEY="ib_pk_..."

curl https://api.ibubbl.com/v1/webhooks \
  -H "Authorization: Bearer $IBUBBL_API_KEY"

const res = await fetch("https://api.ibubbl.com/v1/webhooks", {
  headers: { Authorization: `Bearer ${process.env.IBUBBL_API_KEY}` },
  signal: AbortSignal.timeout(10_000),
});

const data = await res.json();
if (!res.ok) throw new Error(`${res.status} ${data.detail?.error}`);
console.log(`key works: ${data.length} subscription(s)`);

import os

import requests

API_KEY = os.environ["IBUBBL_API_KEY"]

res = requests.get(
    "https://api.ibubbl.com/v1/webhooks",
    headers={"Authorization": f"Bearer {API_KEY}"},
    timeout=10,
)
data = res.json()
if not res.ok:
    raise RuntimeError(f"{res.status_code} {data['detail']['error']}")
print(f"key works: {len(data)} subscription(s)")

​

Revocation and rotation

• Rotate any key whose holder has changed (employee offboarding, vendor change).
• Rotate at least annually for long-lived integrations.
• Rotate immediately if a key may have been exposed (committed to a repo, posted in chat, etc.).

1. Create a new key.
2. Deploy the new key to your integration.
3. Verify traffic is flowing using the new key (check the dashboard’s “last used” timestamp on each key).
4. Revoke the old key.

​

Security best practices

• Server-side only. Never embed an iBubbl API key in a mobile app, browser bundle, or any client-controlled environment. The key has full account access.
• One key per integration. Issue a separate key per service or environment so you can revoke one without breaking the others.
• Least-privilege isn’t a thing yet. API keys carry full account access; scoped keys are on the roadmap.

​

Authentication errors

• Missing Authorization header.
• Header doesn’t start with Bearer (note the space).
• Token doesn’t start with ib_pk_.
• Token has been revoked, or never existed.

{
  "detail": {
    "error": "unauthorized",
    "message": "API key required (use Authorization: Bearer ib_pk_…)"
  }
}

​

Suspended accounts

{
  "detail": {
    "error": "forbidden",
    "message": "Account is suspended"
  }
}