Authentication and keys

The public API lives at https://api.pushtifly.com/v1. Every request carries a key in the header:

Authorization: Bearer sk_live_…

Key types

Key	Where it goes	It can
Public pk_test_… / pk_live_…	Inside your app (it isn't secret)	Register and update devices (devices:write) and report events (events:write). Nothing else.
Secret sk_test_… / sk_live_…	Only on your server. Never in the app or the browser	Also: send (notifications:send), query sends (notifications:read), list devices (devices:read) and manage topics (topics:write).

When you create a key you can reduce its permissions, restrict it to one app and, for secret keys only, to an IP allowlist (IP or CIDR range). Using a public key on an endpoint that requires a secret one returns 1006.

Test mode and live mode

With a test key everything works the same, but sends only reach devices marked as test devices. That way you integrate without risk of bothering real users. Live keys send to the real audience.

Keys restricted to one app

If the key isn't restricted to an app, pass appId in the query or in the body. If it is, appId isn't needed.

Response format

All responses have the same shape:

{ "errCode": 0, "errMsg": "", "data": { }, "meta": { "requestId": "01J…" } }

• errCode: 0 is success. Any other value is an error: see the error catalog.
• Validation errors add errors with the field and the reason.
• meta.requestId identifies the request: include it if you contact support.
• errMsg is a human-readable explanation in Spanish; your code should rely on errCode.

Rate limits

Each key has a per-minute limit depending on the plan (120 on trial, 300 on Basic, 1,200 on Pro). Every response includes:

X-RateLimit-Limit: 300
X-RateLimit-Remaining: 287

When you exceed it you get 429 with errCode 3003 and Retry-After. See Limits and quotas.

Idempotency

On POST /v1/notifications send a unique Idempotency-Key header per logical send (for example your order id). If you repeat the request with the same key within 24 h, you get the original notification without a duplicate. If you repeat it with a different body: 4005.

Security best practices

• Rotate keys from the panel: the previous one keeps working for 24 hours, so you can update your configuration without downtime.
• Restrict secret keys by IP.
• If a key leaks, revoke it immediately.