Ingest API
Where reports go. The SDKs call it for you; you only need the raw contract when building a custom client. Authenticated with your app’s SDK key, which ships inside your application.
Ticket API
Create tickets from your own systems — CI, scripts, a bot. Authenticated with an API token you generate in the dashboard. Because a token can write into your projects, it is a different credential from an SDK key and must never be embedded in a shipped application.
Which credential?
| SDK key | API token | |
|---|---|---|
| Prefix | evf_live_ | evf_api_ |
| Lives in | Your shipped app | Your CI or server, never shipped |
| Scope | One app | An organisation, optionally narrowed to projects |
| Can | Submit reports | Create tickets |
| Recoverable | Yes, from the dashboard | No — shown once, then rotate |
The split is the point: an SDK key is public by design and can only ever add a report to one app. Leaking one is a nuisance, not an incident. An API token is the opposite on both counts.