trophyso · cbrinicombe13 · Jul 24, 2026 · Jul 23, 2026 · Jul 24, 2026 · Jul 24, 2026
diff --git a/admin-api/authentication.mdx b/admin-api/authentication.mdx
@@ -1,15 +1,102 @@
 ---
 title: Authentication
-description: Integrate securely with the API using account-level API keys
-  transmitted in the `X-API-KEY` header.
-og:description: Integrate securely with the Trophy API using account-level API
+description: Integrate securely with the Admin API using account-level admin API
   keys transmitted in the `X-API-KEY` header.
+og:description: Integrate securely with the Trophy Admin API using account-level
+  admin API keys transmitted in the `X-API-KEY` header.
 icon: key
 ---
 
-The Trophy Admin API is authenticated using the same API keys as the [Application API](/api-reference/authentication).
+import AdminApiAuthenticateRequestBlock from "../snippets/admin-api-authenticate-request-block.mdx";
+import ApplicationApiAuthenticateRequestBlock from "../snippets/application-api-authenticate-request-block.mdx";
+
+<Tip>
+  For client-side or end-user access to the Application API, create
+  [application API keys](/api-reference/authentication) scoped to a single user
+  instead.
+</Tip>
+
+## Admin API keys {#admin-api-keys}
+
+Admin API keys are account-level credentials with broad permissions. Use them to authenticate requests to the Admin API, and optionally to the [Application API](/api-reference/authentication) from trusted server-side environments.
+
+Every account can create a maximum of 3 admin API keys from the [integration page](https://app.trophy.so/integration) of the Trophy dashboard.
+
+Trophy keeps track of and displays when each admin API key in your account was created and when it was last used so you can easily keep track of usage.
+
+<Frame>
+  <img height="200" noZoom src="../assets/api/authentication/api_keys.png" />
+</Frame>
+
+<Warning>
+  Admin API keys can access any user and any admin operation in your account.
+  Never expose them in client-side code, mobile apps, or public repositories.
+</Warning>
+
+### Anatomy of an admin API key {#anatomy-of-an-admin-api-key}
+
+Each admin API key is made up of 2 parts separated by a period:
+
+```bash
+{prefix}.{body}
+```
+
+- The _prefix_ is the first 8 characters. It's readable and will always stay the same so it's easily recognisable.
+- The _body_ is the secret part, and is only shown to you once when you create the key.
+
+<Note>
+  When using the API, both parts of your admin API key must be sent in the
+  `X-API-KEY` header.
+</Note>
+
+### Authenticating requests {#authenticating-requests}
+
+When making requests to the Admin API, include both parts of your admin API key in the `X-API-KEY` header, or pass it when initializing an SDK client:
+
+<AdminApiAuthenticateRequestBlock />
+
+The same key authenticates Application API requests when you use an admin API key from a server-side environment:
+
+<ApplicationApiAuthenticateRequestBlock />
+
+If you do not pass an API key, or your API key is invalid, you'll receive a `401` response code.
+
+## Managing admin API keys {#managing-admin-api-keys}
+
+There are a few different operations you can perform on admin API keys from within your Trophy dashboard to manage your integration.
+
+<Frame>
+  <img
+    height="200"
+    noZoom
+    src="../assets/api/authentication/api_key_options.png"
+  />
+</Frame>
+
+### Rotating keys {#rotating-keys}
+
+Admin API keys can be rotated if you want to change them for any reason. At the point of rotation, the original API key will no longer function and any requests still using it will begin receiving `401` responses immediately.
+
+<Note>
+  Note that when rotating keys, both the prefix and the body will change.
+</Note>
+
+### Revoking keys {#revoking-keys}
+
+Admin API keys can also be revoked entirely at which point they become _Inactive_. At the point of revocation, the API key will no longer function and any requests still using it will begin receiving `401` responses immediately.
+
+Once revoked you can re-activate the API key at any time.
+
+<Note>
+  Neither the prefix or the body of the key change when revoked or re-activated.
+</Note>
+
+### Deleting API keys {#deleting-api-keys}
+
+If you're 100% sure you no longer need an admin API key, they can be deleted.
+
+<Error>Once API keys are deleted, they cannot be recovered.</Error>
 
 ## Get Support {#get-support}
 
 Want to get in touch with the Trophy team? Reach out to us via [email](mailto:support@trophy.so). We're here to help!
-
diff --git a/admin-api/endpoints/application-api-keys/create-application-api-keys.mdx b/admin-api/endpoints/application-api-keys/create-application-api-keys.mdx
@@ -0,0 +1,10 @@
+---
+title: Create application API keys for users
+openapi: openapi/admin.yml post /application-api-keys
+---
+
+import { RateLimitBadge } from "../../../components/rate-limit-badge.jsx";
+
+**Rate Limits**
+
+<RateLimitBadge tier={1} />
diff --git a/admin-api/endpoints/application-api-keys/delete-application-api-keys.mdx b/admin-api/endpoints/application-api-keys/delete-application-api-keys.mdx
@@ -0,0 +1,10 @@
+---
+title: Delete application API keys
+openapi: openapi/admin.yml delete /application-api-keys
+---
+
+import { RateLimitBadge } from "../../../components/rate-limit-badge.jsx";
+
+**Rate Limits**
+
+<RateLimitBadge tier={1} />
diff --git a/admin-api/introduction.mdx b/admin-api/introduction.mdx
@@ -26,7 +26,7 @@ Learn more about how to integrate with the Trophy Admin API below.
 
 <CardGroup>
   <Card title="Authentication" icon="key" href="/admin-api/authentication">
-    Securely integrate your applications with the Trophy Admin API.
+    Authenticate with account-level admin API keys.
   </Card>
   <Card
     title="Rate Limiting"

diff --git a/api-reference/authentication.mdx b/api-reference/authentication.mdx
@@ -1,82 +1,86 @@
 ---
 title: Authentication
-description: Integrate securely with the API using account-level API keys
-  transmitted in the `X-API-KEY` header.
-og:description: Integrate securely with the Trophy API using account-level API
-  keys transmitted in the `X-API-KEY` header.
+description: Authenticate with the Application API using user-scoped application
+  API keys transmitted in the `X-API-KEY` header.
+og:description: Authenticate with the Trophy Application API using user-scoped
+  application API keys transmitted in the `X-API-KEY` header.
 icon: key
 ---
 
-## API Keys {#api-keys}
+import CreateApplicationApiKeysRequestBlock from "../snippets/create-application-api-keys-request-block.mdx";
+import DeleteApplicationApiKeysRequestBlock from "../snippets/delete-application-api-keys-request-block.mdx";
+import ApplicationApiAuthenticateRequestBlock from "../snippets/application-api-authenticate-request-block.mdx";
 
-Every account can create a maximum of 3 API keys from the [Integration Page](https://app.trophy.so/integration). If you've already signed up, you'll have created one during onboarding.
+## API key types {#api-key-types}
 
-Trophy keeps track of and displays when each API key in your account was created and when it was last used so you can easily keep track of usage.
+The Application API accepts two types of API keys:
 
-<Frame>
-  <img height="200" noZoom src="../assets/api/authentication/api_keys.png" />
-</Frame>
+| Key type | Scope | Where to use | Safe client-side? |
+| --- | --- | --- | --- |
+| [Application API keys](#application-api-keys) | Single user | Application API only | Yes |
+| [Admin API keys](/admin-api/authentication) | Entire account | Application API and Admin API | No |
 
-### Anatomy of an API key {#anatomy-of-an-api-key}
+Use application API keys when you want end users or client apps to call the Application API with permissions limited to one user. Use [admin API keys](/admin-api/authentication) for trusted server-side integrations that need broad access.
 
-Each API key is made up of 2 parts separated by a period:
+## Application API keys {#application-api-keys}
 
-```bash
-{prefix}•{body}
-```
+Application API keys are scoped to a specific user. Each key can only perform Application API operations on behalf of the user it was created for, which makes them safe to expose in client-side environments.
 
-- The _prefix_ is the first 8 characters. It's readable and will always stay the same so it's easily recognisable.
-- The _body_ is the secret part, and is only shown to you once when you create the key.
+Application API keys cannot be used with the Admin API.
 
-<Note>
-  When using the API, both parts of your API key must be sent in the `X-API-KEY`
-  header.
-</Note>
+### Creating application API keys {#creating-application-api-keys}
 
-### Authenticating Requests {#authenticating-requests}
+Create application API keys with the [Admin API](/admin-api/endpoints/application-api-keys/create-application-api-keys). You authenticate that request with an [admin API key](/admin-api/authentication).
 
-When making requests to the API, make sure to include **both** parts of your API key in the `X-API-KEY` header as in this example:
+You can create keys for up to 100 users per request. The full key value is returned once at creation time and cannot be retrieved again—store it securely or deliver it to the client immediately.
 
-```bash
-curl https://app.trophy.so/api/users/<userId>/metrics/<key> \
-     -H "X-API-KEY: ********.***********************"
-```
+<CreateApplicationApiKeysRequestBlock />
 
-If you do not pass an API key, or your API key is invalid, you'll receive a `401` response code.
+A successful response includes the key ID (used later to delete the key), the user ID, the full key, and a readable prefix:
 
-## Managing API keys {#managing-api-keys}
+```json
+{
+  "created": [
+    {
+      "id": "550e8400-e29b-41d4-a716-446655440000",
+      "userId": "user_123",
+      "key": "app_XXXXX.YOUR_API_KEY",
+      "prefix": "app_XXXXX"
+    }
+  ],
+  "issues": []
+}
+```
 
-There are a few different operations you can perform on API keys from within your Trophy dashboard to manage your integration.
+### Anatomy of an application API key {#anatomy-of-an-application-api-key}
 
-<Frame>
-  <img
-    height="200"
-    noZoom
-    src="../assets/api/authentication/api_key_options.png"
-  />
-</Frame>
+Each application API key is made up of 2 parts separated by a period:
 
-### Rotating keys {#rotating-keys}
+```bash
+{prefix}.{body}
+```
 
-API keys can be rotated if you want to change them for any reason. At the point of rotation, the original API key will no longer function and any requests still using it will begin receiving `401` responses immediately.
+- The _prefix_ identifies the key (for example `app_XXXXX`) and is safe to log or display.
+- The _body_ is the secret part, and is only shown once when you create the key.
 
 <Note>
-  Note that when rotating keys, both the prefix and the body will change.
+  When using the API, both parts of your application API key must be sent in the
+  `X-API-KEY` header.
 </Note>
 
-### Revoking keys {#revoking-keys}
+### Authenticating requests {#authenticating-requests}
 
-API keys can also be revoked entirely at which point they become _Inactive_. At the point of revocation, the API key will no longer function and any requests still using it will begin receiving `401` responses immediately.
+Include the full application API key in the `X-API-KEY` header on Application API requests, or pass it when initializing an SDK client. The key only authorizes operations for the user it is scoped to—requests for other users return an error.
 
-Once revoked you can re-activate the API key at any time.
+<ApplicationApiAuthenticateRequestBlock />
 
-<Note>
-  Neither the prefix or the body of the key change when revoked or re-activated.
-</Note>
+If you do not pass an API key, or your API key is invalid, you'll receive a `401` response code.
+
+### Deleting application API keys {#deleting-application-api-keys}
 
-### Deleting API keys {#deleting-api-keys}
+Delete application API keys by ID with the [Admin API](/admin-api/endpoints/application-api-keys/delete-application-api-keys). Use the UUID returned when the key was created.
 
-If you're 100% sure you no longer need an API key, they can be deleted.
+<DeleteApplicationApiKeysRequestBlock />
 
 <Error>Once API keys are deleted, they cannot be recovered.</Error>
 

diff --git a/api-reference/introduction.mdx b/api-reference/introduction.mdx
@@ -24,7 +24,7 @@ Learn more about how to integrate with the Trophy Application API below.
 
 <CardGroup>
   <Card title="Authentication" icon="key" href="/api-reference/authentication">
-    Securely integrate your applications with the Trophy API using API keys.
+    Authenticate with user-scoped application API keys or account-level admin API keys.
   </Card>
   <Card
     title="Rate Limiting"

diff --git a/api-reference/rate-limiting.mdx b/api-reference/rate-limiting.mdx
@@ -13,8 +13,8 @@ Trophy operates a tiered rate limiting model for each API endpoint. All rate lim
 
 | Tier | Rate Limit |
 | ---- | ---------- |
-| <RateLimitBadge tier={1} noTooltip /> | 10 req/s |
-| <RateLimitBadge tier={2} noTooltip /> | 100 req/s |
+| <RateLimitBadge tier={1} noTooltip /> | 5 req/s |
+| <RateLimitBadge tier={2} noTooltip /> | 50 req/s |
 
 <Tip>
   If you feel you need a higher rate limit, then please [contact

diff --git a/components/rate-limit-badge.jsx b/components/rate-limit-badge.jsx
@@ -13,9 +13,9 @@ export const RateLimitBadge = ({ tier, noTooltip = false }) => {
   const getLimit = (tier) => {
     switch (tier) {
       case 1:
-        return 10;
+        return 5;
       case 2:
-        return 100;
+        return 50;
     }
   };
 

diff --git a/docs.json b/docs.json
@@ -301,6 +301,13 @@
                   "admin-api/endpoints/tenants/create-tenants",
                   "admin-api/endpoints/tenants/delete-tenants"
                 ]
+              },
+              {
+                "group": "Application API Keys",
+                "pages": [
+                  "admin-api/endpoints/application-api-keys/create-application-api-keys",
+                  "admin-api/endpoints/application-api-keys/delete-application-api-keys"
+                ]
               }
             ]
           },