API key

The API key is not considered secret. It's used, among other things, in front-end behavioral tracking requests sent by browsers, and is therefore visible in network calls from the browser.

API token

The API token, however, is considered secret and should be treated as sensitive data. It should only ever be sent via SSL to Constructor's API from back-end, secure servers. The API token should be treated like a password and carefully protected. On Constructor's side, the token is not stored in plain text, but as a one-way hash. API tokens value cannot be viewed or retrieved by Constructor.

For more information, please refer to the following guide: getting started