SDK Authentication

All SDK requests require a per-app API key. Each key is tied to a single app and authenticates every request the SDK makes to the OpenLynk backend.

Generating an API Key

1. Open your app in the OpenLynk dashboard.
2. Find the SDK API Key card.
3. Click Generate.
4. Copy the key immediately -- it is shown only once.

caution

The API key is displayed only at the time of creation. If you lose it, you must rotate or revoke the key and generate a new one.

Key Format

Keys follow the format ol_ followed by 32 hexadecimal characters:

ol_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6

Passing the Key During SDK Init

You provide the API key once when creating the SDK instance. Every subsequent SDK call uses this key automatically.

Flutter

final sdk = OpenlynkSDK(
  appId: 'your-app-id',
  apiKey: 'ol_your_api_key_here',
);

iOS (Swift)

let sdk = OpenlynkSDK(
    appId: "your-app-id",
    apiKey: "ol_your_api_key_here"
)

Android (Kotlin)

val sdk = OpenlynkSDK.create(
    context = this,
    appId = "YOUR_APP_ID",
    apiKey = "ol_your_api_key_here",
)

Android (Java)

OpenlynkSDK sdk = new OpenlynkSDK(
    this, "YOUR_APP_ID", "ol_your_api_key_here"
);

Rotating Keys

To rotate a key:

1. Go to your app's page in the OpenLynk dashboard.
2. Click Rotate on the SDK API Key card.
3. The old key is revoked immediately and a new key is generated.
4. Copy the new key, update your SDK initialization code, and redeploy your app.

warning

After rotation, the old key stops working immediately. All in-flight app versions still using the old key will receive 401 Unauthorized errors. Plan your deployment so you can update the key quickly.

Revoking Keys

To revoke a key without generating a replacement:

1. Click Revoke on the SDK API Key card.
2. All SDK requests using that key will return 401 Unauthorized.

Generate a new key when you are ready to restore SDK access.

Using the Key from Your Backend

You can use the same API key to call the REST API from a server (admin panels, invite services, automation). Pass it as:

Authorization: Bearer ol_your_api_key_here

or:

x-openlynk-sdk-key: ol_your_api_key_here

Typical server use: create invite links and put link.url in an email.

warning

Only call the REST API from a trusted backend. Do not expose the key in browser JavaScript or public clients other than your signed mobile app builds.

Security Best Practices

• Never commit API keys to source control. Use environment variables, a secrets manager, or your CI/CD system's secret store.
• Rotate keys periodically or whenever a team member with access leaves your organization.
• Use one key per app. Each app has its own key; sharing keys across apps is not supported.
• Keys are hashed server-side. OpenLynk stores a SHA-256 hash of each key, not the plaintext value.
• Server and mobile share the same key today. Dedicated server-only keys are planned; until then, rotate promptly if either side is compromised.

tip

For mobile apps, the API key is embedded in the compiled binary and is not trivially extractable. However, treat it as a client-side credential and avoid exposing it in logs or error messages.

Troubleshooting

Error	Cause	Fix
401 Missing API key	No apiKey provided during SDK initialization	Pass the apiKey parameter when creating the SDK instance
401 Invalid API key	The key does not match any active key for this app	Check for typos, or generate a new key from the dashboard
401 after rotation	The app is still using the old (revoked) key	Update the key in your SDK initialization code and redeploy

What's Next?

• Create invite links from your server for admin-panel / email invites.
• REST API reference for all SDK endpoints you can call directly.
• Implement link sharing to let your users share deep links.
• Handle deep links to navigate users to the right screen when they open a link.
• See the full SDK reference for your platform: Flutter, iOS, Android Kotlin, Android Java.