Use this article to understand what the ROOK Secret Key is, how it works with your client_uuid, and how to manage it securely for Sandbox and Production.
What is the ROOK Secret Key?
The ROOK Secret Key is a confidential credential used to securely authenticate requests to supported ROOK API endpoints.
It is commonly used together with your client_uuid for Basic Authentication.
Your Secret Key should only be accessible to systems and team members that require it for the ROOK integration.
How is the Secret Key used for ROOK API authentication?
For ROOK API endpoints that use Basic Authentication, your client_uuid and Secret Key are used together to authenticate the request.
Conceptually, the credentials are combined as:
client_uuid:secret_key
and sent using Basic Authentication.
Always check the ROOK API Reference for the authentication requirements of the endpoint you are implementing.
Do Sandbox and Production use the same Secret Key?
No. Sandbox and Production use separate credentials.
Your Sandbox Secret Key should only be used with your Sandbox environment.
Your Production Secret Key should only be used with your Production environment.
Before configuring your application, confirm that the Secret Key and client_uuid belong to the same ROOK environment.
Where can I generate my Secret Key?
You can generate your Secret Key from the Credentials area of the ROOK Portal for the selected environment.
Important: The Secret Key is displayed when it is generated. Store it securely because you will not be able to retrieve the same Secret Key later.
What happens if I lose my Secret Key?
If you lose your ROOK Secret Key, generate a new Secret Key from the ROOK Portal.
Generating new credentials does not delete your users' existing health data.
However, credentials that are no longer valid will not authenticate API requests, so update any backend services or integrations that depend on the previous Secret Key.
How should I store my ROOK Secret Key?
The ROOK Secret Key is confidential and should be treated like any other sensitive API credential.
As a security best practice:
Store it in a secure secrets manager or protected environment variable.
Do not commit it to a public or private source-code repository.
Do not expose it directly in frontend code.
Do not include it in public documentation, screenshots, or support messages.
If you believe a Secret Key has been exposed, generate a new one and update your integration.