Server-side API Authorization and request format
Authorization
API requests must be authenticated with either your secret or your public API key as an Authorization header. You can find them in the App Settings. The format of the value is Api-Key {your-secret-api-key}, for example, Api-Key secret_live_....
API keys are app-specific. If you have several apps, ensure you are using different keys for each of them.
Request format
Headers
The server-side API requests require specific headers and a JSON body. Use the details below to structure your requests.
| Header | Description |
|---|---|
| adapty-profile-id | The user’s Adapty profile ID. Visible in the Adapty ID field in the Adapty Dashboard -> Profiles -> specific profile page. Interchangeable with adapty-customer-user-id, use any of them. |
| adapty-customer-user-id | The user’s ID in your system. Visible in the Customer user ID field in the Adapty Dashboard -> Profiles -> specific profile page. Interchangeable with adapty-profile-id, use any of them. ⚠️ Works only if you identify users in your app iOS, Android, React Native, Flutter, and Unity in your app code using the Adapty SDK. |
| adapty-platform | (optional) Specify the platform of the device on which the app is installed. We recommend setting this parameter in the Create profile and Update profile requests when modifying the Installation Meta object, as it depends on the device the user is using, and a single user may have multiple devices. Possible values: iOS, macOS, iPadOS, visionOS, Android, or web. |
| Content-Type | Set to application/json for the API to process the request. |
Body
The API expects a JSON-formatted body with the necessary data for the request.
Rate limits
Rate limits are enforced per API key, and the limit that applies to your app is assigned to your key — there is no single figure that holds for every app. If you are sizing a high-volume integration, or you start receiving 429 responses, ask support which limit applies to your app.
Two things to design around:
- The limit is a sustained rate, not a per-minute budget. Requests are smoothed across the window and only a short burst above the rate is absorbed, so a steady request rate goes considerably further than sending a minute’s worth of traffic at once.
- Some endpoints have their own, lower limit. Create virtual currency transaction allows 600 requests per minute per app by default, independently of your app’s overall limit.
Requests over a limit fail with 429 Too Many Requests. Retry with backoff, and honor the Retry-After header when the response carries one.
Rotate API keys
If you need to rotate secret API keys:
- In Settings → General, click Generate new key, then click the trash icon next to the old key.
- Update the key used in your app.
What’s next: requests: