Authentication
Create, use, scope, and revoke Pepvote API keys.
Create an API key in Profile → API keys. Give it a clear name, choose its scopes, and copy it when Pepvote shows it. Store it in a server-side secret manager. Pepvote cannot show the full key again.
Send a bearer key
Send the key in every authenticated request:
Authorization: Bearer pepvote_api_0123456789abcdef0123456789abcdefA valid key starts with pepvote_api_ followed by 32 lowercase hexadecimal characters. Invalid, revoked, or expired keys return 401 unauthorized.
Scopes
| Scope | Access |
|---|---|
read | Read API resources. |
write | Read resources and create, update, or delete them. |
A key acts as the person who created it. It can only access events and actions that person can access in Pepvote. A missing scope returns 403 insufficient_scope.
Revoke a key
Open Profile → API keys, select the key, then revoke it. Revoked keys stop working immediately. Create a replacement key before removing a key used by a live integration.
Keep keys off the client
Do not put an API key in browser JavaScript, mobile app bundles, public repositories, or client-side analytics. The API does not provide CORS headers by design. Call Pepvote from your server, server action, worker, or trusted automation platform.
Last updated September 5, 2026