Authentication & API keys
Every request authenticates with a bearer credential issued in the console. Which credential you use depends on which plane you're calling.
Product API keys
Calculation calls (equity, ICM, payouts, blinds, chip stacks) use a product API key, sent as a bearer token:
Code
Product keys are environment-scoped:
pw_test_…— the test environment. Free credits, no card required.pw_live_…— production traffic. Draws from your credit wallet and requires a card on file.
Product keys are long-lived server-side bearer credentials. Do not put pw_test_… or pw_live_…
keys into browser, mobile, or embedded code.
Management tokens
Automating the console itself — creating projects, rotating keys, reading usage — uses a
service-account management token (pw_mgmt_…), not a product key. Management tokens never make
calculation calls. See Service accounts & management tokens.
Management tokens are also server-side only. They can be restricted to allowed projects and
environments, so a token can be test-only without using a separate pw_mgmt_test_ prefix.
Key handling
- Keys and tokens are shown once at creation and hashed at rest — copy them then; they can't be recovered, only rotated or revoked.
- Rotate or revoke immediately if a credential is exposed.
- Keep them server-side. Never ship a key or token to a browser or client app.
- Browser and embedded flows use short-lived launch/session credentials, not long-lived product keys
or management tokens. For example, your server uses a
pw_mgmt_…token to create an embed session, then the browser receives the returned launch URL, which carries apwes_…launch secret in the URL fragment for that session. - PokerWorks does not currently offer a publishable client-side API key. If that is added later, it will be a separate, origin-bound, rate-limited credential class.
Scopes & project-scoping
Product API keys use Calculation API scopes:
| Scope | Grants |
|---|---|
calculations:read | Call calculation endpoints such as equity, ICM, payouts, blinds, and chip stacks. |
usage:read | Read usage for the key's organization/project/environment where supported. |
org:read | Read organization metadata exposed to product-key clients. |
Management tokens use Management API scopes:
Code
Product keys always belong to one project and one environment. Management tokens can be restricted
to a set of project IDs and environments; those restrictions apply in addition to scopes. For
example, a token with product_keys:create restricted to one project can create keys only for that
project, and a token restricted to test cannot create or read live-environment resources.