SDK
SDK and server keys
The two kinds of keys, where each belongs, and how to rotate them.
Every request to the SDK API is signed with a key. There are two kinds.
Never put a server key in an app
A secret shipped in an app can be extracted from the APK or IPA. Signing with an SDK key stops casual abuse and replays, but it doesn't prove a request came from your real app. Server keys must stay on your servers.
Getting keys#
Registering an app creates one SDK key per platform and one server key. Secrets are shown once, in a dialog you can't dismiss by accident. Copy them into your password manager or CI secrets. Dropplink never stores them in the dashboard, and they can't be shown again. A lost secret means creating a new key.
Find your keys in Settings → SDK keys. Each kind allows 2 active keys (per platform for SDK keys), so you can rotate without downtime.
Rotating a key#
Create a new key
Create key → Android SDK key (or iOS, or Server key). Save the new secret.
Ship it
Release an app version (or deploy your backend) that uses the new key.
Revoke the old key
Once enough users have updated, choose Revoke on the old key. Requests signed with it are rejected within 30 seconds, so installs on app versions still using it stop being tracked.