Server API
Quick answer
Use the Server API when your backend owns sessions, orchestration, or rollout policy and must keep secret keys off browser clients.
POST /v1/placements creates the default placement response, while the hosted renderer owns browser media rendering.
Server API is the recommended default backend path. Use it when your backend already owns session state, orchestration, or rollout policy, while Wavebird owns hosted media rendering in the browser.
.env.local
bash
create-placement.sh
bash
chat.html
html
advanced-policy-controls.json
json
direct-server-beacon.mjs
javascript
Backend control
Why use the server path
Own the lifecycle
Request placements from your backend without exposing secret keys to the browser.
Keep secrets server-side
The secret-key path is simpler when your app already has a backend and does not need direct browser-side monetization control.
Pair with your renderer
Use the hosted renderer for the default path, or keep raw decision polling only for advanced compatibility flows.
Credentials
Server Test Key
Start with a Server Test Key from Dashboard API Keys. The full sk_test_... value is shown only when the key is created or rotated, so copy it immediately into WAVEBIRD_SECRET_KEY. If the dashboard only shows a masked preview, create or rotate a Server Test Key before running the Server API examples. Test/Sandbox requests are non-billable.
Credentials
Key classes
Server Test Key
Use sk_test_... only from your backend for Test/Sandbox requests. These requests are non-billable.
Server Production Dry-run Key
Use sk_dry_... only from your backend for non-billable pre-live dry-run. Dry-run is selected by credential class, not by request fields.
Server Production Key
Use a Server Production Key only after Dashboard live readiness, SSP readiness, payout requirements, and live approval gates are complete.
Browser Publishable Key
Use a Browser Publishable Key only for browser activation and Script Tag flows with allowed origins. Do not put server secrets in browser code.
Raw server secrets are shown only once after create or rotate. Existing masked server-secret previews identify a key but are not usable credentials. Do not send production_dry_run, production_billing_dry_run, billing_suppressed, or production_live_approved in request bodies.
Contracts
Consent and beacon boundaries
Request-level placement consent
Send semantic_targeting, prompt_shared, gdpr_applies, and consent_source inside /v1/placements when consent is scoped to the current request. This does not require a prior /v1/consent sync.
Separate /v1/consent sync
Use /v1/consent only when you want to persist a session or user consent decision outside a single placement request.
Hosted renderer beacons
The default renderer path sends browser beacons automatically to /public/wrapper/v1/beacons. Most integrations do not need manual beacon code.
Direct server beacons
Use /v1/beacons only for advanced server-rendered, custom-rendered, or QA validation flows. It requires the issued asset_token, a fresh occurred_at, and idempotent beacon_id values.
Troubleshooting
Timestamp freshness
Avoid BEACON_TOO_LATE
occurred_at must be close to when the event actually happened. Copying an old static sample timestamp can return BEACON_TOO_LATE. Generate it at runtime with const occurred_at = new Date().toISOString();.
Need rollout review?
Start with the Server API. Use contact only when you need rollout review, enterprise coordination, or non-standard integration help.