GitHub project

Authentication

To use the SDK, you need a public API key (beginning with pk_) to send data to Customer.io. If you're upgrading from an earlier SDK version, you also need your Site ID.

To get your SDK keys and send data to the right places, you’ll need to set up your app as a data in integration in Customer.io, and route it to your workspace. The SDK lets you route data to any number of destinations, but you must connect it to your workspace destination to send data, like the people you identify, the events you track, and so on, to Customer.io.

If you haven’t already set up your app as an integration in Customer.io, do that first.

Which key goes in your app

Your app uses a public key, which starts with pk_. Public keys are safe to include in your app. Private keys start with sk_ and have much broader access to your workspace, so keep them in your backend systems where your users can’t get to them. See public and private keys.

API Keys you’ll need

  1. Public API key: This key starts with pk_ and is shown in code samples as cdpApiKey. It lets your app send data to Customer.io, and you need it to initialize the SDK. You get this key when you set up your mobile app as a data in integration in Customer.io, or you can create one for an existing integration on the API Credentials page.
  2. Site ID: If you’re upgrading from a previous version of the Customer.io SDK, you set your Site ID as the migrationSiteId. In SDK versions before 4.25.0, you also need it to initialize the MessagingInApp package. In 4.25.0 and later, the SDK uses your public key for in-app messages instead.

Get your public key

You’ll use your public key to initialize the SDK and send data to Customer.io; you’ll get this key from your mobile app’s integration card in Customer.io. If you haven’t already set up your Android integration in Customer.io, you’ll need to do that first.

  1. Go to Integrations and click Add Integration.
  2. On the Overview tab, select your Android integration. If you don’t see your Android integration, you’ll need to set one up.
    the connections page, showing an android source connected to a journeys destination
  3. Go to Settings and find your public key. It starts with pk_. Copy this key into your initialization call. If you’re upgrading from a previous version of the SDK, you should keep the siteId that you used in previous versions as the migrationSiteId in your config.
    The API keys section of your integration's Settings tab, showing your public key
    KOTLIN
    val builder = CustomerIOConfigBuilder(
        applicationContext = this,
        cdpApiKey = "your_cdp_api_key"
    ).addCustomerIOModule(
        ModuleMessagingInApp(
            config = MessagingInAppModuleConfig.Builder()
                .setEventListener(InAppMessageEventListener()).build()
        )
    ).addCustomerIOModule(ModuleMessagingPushFCM())
    
    CustomerIO.initialize(builder.build())
    

Upgrading from an earlier SDK version?

You still need your Site ID to support people updating your app from a previous version of the Customer.io SDK. If you use an SDK version before 4.25.0, you also need it to initialize the MessagingInApp package. See Get your Site ID below.

Set up a new integration in Customer.io

If you don’t already have a public key, you’ll need to set up a new data in integration in Customer.io. The “integration” represents your app and the stream of data that you’ll send to Customer.io.

  1. Go to Integrations and click Add integration.
  2. Select Android.
    set up your android source
  3. Enter a Name for your integration, like “My Android App”.
  4. Click the Copy and paste code tab. The code sample includes your public key (beginning with pk_) as cdpApiKey. Copy this key and keep it handy; you’ll need it to initialize the SDK.
    The integration setup screen, with a name for your integration and a code sample that includes your public key
  5. Click Test connection to check that Customer.io receives data from your app, and then click Complete setup. If you aren’t ready to test your app yet, click Save for later.

Now the Integrations page shows that your Android integration is connected to your workspace. You can also connect your Android integration to other services if you want to send your mobile data to other places outside of Customer.io—like your analytics provider, data warehouse, or CRM.

Get your Site ID

If you’re upgrading from a previous version of the SDK, you set your Site ID as your migrationSiteId. The SDK uses it to send remaining tasks to Customer.io when your audience updates your app.

If you use an SDK version before 4.25.0, you also need your Site ID to initialize the MessagingInApp package. In 4.25.0 and later, the SDK uses your public key for in-app messages, so you can leave the Site ID out of MessagingInAppModuleConfig.Builder().

  1. Go to and select Workspace Settings in the upper-right corner of the Customer.io app and go to API and Webhook Credentials.

  2. Copy the Site ID for the set of credentials that you want to send your in-app messages from. If you don’t have a set of credentials, click Create Tracking API Key.

    find your site ID
  3. Set this key as your migrationSiteId. If you use an SDK version before 4.25.0, also pass it to MessagingInAppModuleConfig.Builder.

    KOTLIN
    val builder = CustomerIOConfigBuilder(
        applicationContext = this,
        cdpApiKey = "your_cdp_api_key"
    ).migrationSiteId("your_site_id")
        .addCustomerIOModule(
            ModuleMessagingInApp(
                config = MessagingInAppModuleConfig.Builder(
                    siteId = "your_site_id"
                    // Before 4.25.0, also pass region = Region.US, or Region.EU if your account is in the EU.
                ).setEventListener(InAppMessageEventListener()).build()
            )
        )
        .addCustomerIOModule(ModuleMessagingPushFCM())
    
    CustomerIO.initialize(builder.build())
    

Securing your credentials

To simplify things, code samples in our documentation sometimes show API keys directly in your code. But you don’t have to hard-code your keys in your app. You can use environment variables, management tools that handle secrets, or other methods to keep your keys secure if you’re concerned about security.

To be clear, the keys that you’ll use to initialize the SDK don’t provide read access to data in Customer.io; they only write data to Customer.io. A bad actor who found your credentials can’t use your keys to read data from our servers.

Updated October 30, 2026