API Keys vs Bearer Tokens

Make sure you’re using the correct authentication method from the beginning.

When starting to consume our API, one of the most common sources of confusion is the authentication method to use.

There are two types of tokens you may encounter:

• API keys
• Bearer tokens

Although both are used in HTTP requests, they serve different purposes.

API Keys (Recommended for Integrations)

The correct way to authenticate server-to-server integrations with our API is by using an API Key.

To obtain an API key, please request one from an administrator of the Podplay application you are integrating with.

An API key is a long string of characters, for example:

eyJhbGci...KHxazjNpg

API keys:

• Do not expire
• Are intended for backend integrations
• Should be stored securely (e.g., environment variables, secrets manager)
• Must never be exposed in frontend code

Because API keys do not expire, it is important to follow security best practices to keep them safe.

Bearer Tokens (Not for integrations)

Bearer tokens are typically used for authenticating users within the Podplay application.

You may see these tokens in your browser’s developer tools while using the application. However, these tokens:

• Are short-lived
• Expire after a limited time
• Are meant for user session authentication

They are not suitable for long-running integrations.

If you attempt to use a bearer token for an integration, it may work temporarily but will fail once the token expires.

For integrations, always use an API key.