Authentication

All WarpLink API requests require authentication via Bearer token.

Key Types

Type	Use it for	Scopes	Where it goes
SDK key	iOS, Android, and React Native apps	links:read and attribution:write, fixed	WarpLink.configure()
API key	Backend scripts, CI, and AI agents via MCP	You choose	Authorization header

Both use the wl_live_ prefix followed by 32 alphanumeric characters, so check the key type in the dashboard rather than reading the string. Only an SDK key can record install attribution. An API key placed in a mobile SDK resolves deep links normally but silently fails attribution.

Creating Keys

1. Log in to the WarpLink dashboard
2. Go to API Keys
3. Click SDK key for a mobile app, or API key for everything else
4. Name the key. API keys also take a set of scopes and an optional expiry; SDK keys are pre-scoped and never expire
5. Copy the key immediately. It's only shown once

Or create API keys via the API:

curl -X POST https://api.warplink.app/v1/keys \
  -H "Authorization: Bearer wl_live_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "CI/CD Key",
    "scopes": ["links:read", "links:write"]
  }'

Using API Keys

Include the key in the Authorization header:

curl -H "Authorization: Bearer wl_live_YOUR_API_KEY" \
  https://api.warplink.app/v1/links

Scopes

Scope	Access
links:read	Read link data
links:write	Create, update, delete links
apps:read	Read app configuration
apps:write	Create, update, delete apps
analytics:read	Read click analytics
attribution:write	Record install attribution. SDK keys only, not requestable on an API key

Requesting links:write automatically includes links:read.

Security Best Practices

• Never commit API keys to source control
• Use environment variables to store keys
• Create separate keys for different environments (production, staging, CI)
• Set expiration dates on keys that don't need permanent access
• Use the minimum scopes required for each key
• Rotate keys periodically and after team member departures