API Keys

AIDE issues each organization a clientId / clientSecret pair per environment, and owns how keys are issued, rotated and revoked. In AFCore the pair identifies your app for External ID sign-in (signInOrCreateMember). Members who sign in with username and password need no keys, and a session your backend injects with tokens needs no secret -- see Authentication.

Using a key in AFCore

Android (Kotlin)

val config = AFCoreConfig.builder()
    .baseUrl("https://api.example.com")   // environment URL from your Account Manager
    .clientId("…from AIDE…")
    .clientSecret("…from AIDE…")
    .build()

iOS (Swift)

let config = AFCoreConfig.Builder()
    .baseUrl(value: "https://api.example.com")
    .clientId(value: "…from AIDE…")
    .clientSecret(value: "…from AIDE…")
    .build()

• Keep keys out of source control: use your build system's secret manager or fetch them from your backend.
• QA and Production are separate: use QA keys with test members during development and Production keys only for store builds; data never crosses between them.
• A revoked key eventually ends the member's session: handle SessionState.SESSION_EXPIRED by sending the member to sign-in -- see Session Management.

Learn more

Issuing, rotating and revoking keys is documented in AIDE Docs.