Authentication

Windback supports two authentication methods depending on your use case.

JWT Bearer Token

Used by the dashboard and web app. Obtained via login or OAuth.

curl https://api.windbackai.com/api/v1/auth/me \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

Each project has two API keys:

Type	Prefix	Used For
Public	`pub_`	Widget, cancel flow, webhook URLs
Secret	`sk_`	Server-side SDK calls, full API access

Pass the secret key via the X-API-Key header:

curl https://api.windbackai.com/api/v1/projects/my-project/churn-events \
  -H "X-API-Key: sk_live_abc123..."

Never expose your secret key (sk_) in client-side code, public repositories, or browser requests.