Server Secret & Server Routes

Every Abrova project has two credentials. This page explains which one belongs where, and how to make the routes that only your servers use accept the server secret only.

The two credentials#

Both are in Abrova Console under Project settings → Keys. The server secret is shown once, when you create or rotate it — store it in your secret manager or server environment.

What the setting does#

Server routes require the server secret is a per-project switch in Abrova Console under Project settings → Products → Abrova Trace. It is off by default.

When it is on, the routes that only servers and agents call accept the server secret only. A request that carries just the app key is refused there with 401:

Nothing changes for your apps: errors, messages, performance data and logs sent with the app key keep working whether the setting is on or off.

Why you would switch it on#

The app key is public by nature. Without this setting, someone who extracted it from your app could:

• send a fake "job succeeded" cron check-in, hiding a job that is failing or not running,
• write fake deploy markers,
• connect as a fake log agent.

With the setting on, the app key is no longer enough for any of these.

Switch it on when you run the log agent, use cron monitoring, or send deploy markers. A project that only uses the mobile and web SDKs does not need it.

1Give your servers the server secret#

There are two ways to send the server secret over HTTP. Both work on every route in the table above:

• Use the server secret as the key: x-api-key: ab_srv_...
• Keep the app key in x-api-key and add the server secret in a second header: x-server-secret: ab_srv_...

Log agent

The agent takes one credential, in ABROVA_TRACE_API_KEY. Set it to the server secret and redeploy the agent:

docker run -d \
  --name abrova-trace-agent \
  --restart=always \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -e ABROVA_TRACE_API_KEY=ab_srv_your_server_secret \
  ghcr.io/abrova-co/abrova-trace-agent:latest

In a multi-host setup only the collector holds the credential; remote agents need no change. The Abrova desktop app (coming soon) will also deploy the agent; it will ask for this key. See Abrova Trace Agent.

Cron check-ins

curl -X POST https://trace.abrova.ir/api/cron-monitors/check-in \
  -H "X-API-Key: ab_srv_your_server_secret" \
  -H "Content-Type: application/json" \
  -d '{"monitor_slug": "daily-backup", "status": "ok"}'

See Cron Monitoring.

Deploy markers

A deploy marker tells Abrova Trace "a deploy happened now", so the Logs page can show what is new since the last deploy. Call it at the end of your deploy script. Every field is optional:

curl -X POST https://trace.abrova.ir/api/logs/deploys \
  -H "x-api-key: ab_srv_your_server_secret" \
  -H "Content-Type: application/json" \
  -d '{
    "version": "1.4.2",
    "environment": "production",
    "source": "api-server",
    "description": "Checkout fixes"
  }'

Response (201): {"success": true, "deploy": { ... }}

Logs sent from your servers

The Logs REST API is never refused because of this setting, but a server should still authenticate with the server secret rather than the app key. The Node.js and Laravel SDKs already send the server secret you configure them with.

2Check that nothing still uses the app key#

In Abrova Console, open Project settings → Products → Abrova Trace. The line under the switch tells you how recent requests on the server routes authenticated (last 30 days):

• "N requests in the last 30 days used the app key on server routes." — something still sends the app key. Find it and move it to the server secret first.
• "Ready: every request on server routes in the last 30 days used the server secret." — safe to switch on.
• "No requests on server routes in the last 30 days." — nothing uses these routes yet; switching on affects nobody.

3Switch it on#

Turn on Server routes require the server secret and save. From then on, a request on a server route without the server secret gets:

{
  "error": "Server credential required",
  "code": "server_credential_required"
}

A request that sends a wrong x-server-secret gets 401 with "code": "server_credential_invalid".

You can switch the setting off again at any time; the app key is then accepted on these routes as before.

Troubleshooting#