Skip to main content

​
Overview

Access keys connect your website or external tools to Bigdelta. There are two types, each with its own tab under Settings → Access Keys:
  • Tracking keys send visitor data from your website to your workspace
  • API keys give programmatic access to the Bigdelta API

​
Tracking keys

A tracking key identifies your website to Bigdelta. It’s embedded in the tracking script, and every page view, session recording, and custom event it captures lands in your workspace.

​
Creating a tracking key

  1. Go to Settings → Access Keys
  2. Open the Tracking Keys tab
  3. Click Create Tracking Key
  4. Give the key a name (e.g., “Production Website” or “Staging”)
The page shows the installation snippet with your key already filled in — copy it into your site’s <head>, or use the generated AI prompt if your site is built with a tool like Lovable or Cursor. See Connect your website for the full setup guide.
If you have separate environments (e.g., production and staging), create a separate tracking key for each so you can keep your data clean.
Tracking keys are meant to be public — they only accept incoming events, so it’s safe for them to appear in your site’s source code.

​
API keys

API keys are for programmatic access to the Bigdelta API — custom integrations, data imports, or automation outside the Bigdelta interface.

​
Creating an API key

  1. Go to Settings → Access Keys
  2. Open the API Keys tab
  3. Click Create API Key
  4. Give the key a name that describes its purpose
Each API key comes with an API secret, shown alongside the key in the table. You need both to authenticate.
Keep your API keys and secrets secure. Don’t share them publicly or commit them to version control. If a key is compromised, delete it from the table’s row menu and create a new one.

​
Authenticating API requests

The Bigdelta API uses a client credentials flow. Exchange your API key and secret for a short-lived Bearer token before making API calls. Required environment variables:
Get a token:
The response contains a token field. Use it as a Bearer token on all subsequent requests. Use the token: Every API request requires:
  • Authorization: Bearer <token> header
  • Content-Type: application/json header
  • workspace_id=BIGDELTA_WORKSPACE_ID query parameter
Token lifecycle: Cache the token and reuse it until it expires. When it expires, re-authenticate by calling the token endpoint again — there is no refresh token. Store only BIGDELTA_API_KEY and BIGDELTA_API_SECRET in your environment, never the token itself.