Generate an API Key

Each tracking site has its own API keys. A key is scoped to one site — it can only be used to send events for that site’s site_id.

Steps

The raw API key is displayed one time only. If you close the dialog without copying it, you will need to revoke the key and generate a new one.

Save the key as an environment variable in your backend. Never hardcode it in source code.

# .env
SCANOVA_API_KEY=your_key_here

// Node.js
const apiKey = process.env.SCANOVA_API_KEY;

# Python
import os
api_key = os.environ['SCANOVA_API_KEY']

A site can have up to 2 active API keys at a time. Rotate an old key out when you create a new one
Revoke unused or compromised keys immediately from the Track via API tab
With a cap of two, a production/staging split uses both slots — plan rotation accordingly

Include it as a header on every server event request:

POST /server-events HTTP/1.1
Host: track.scanova.io
Content-Type: application/json
X-API-Key: YOUR_API_KEY

The key must match the site_id you include in the request body. A mismatch returns 403.