Skip to main content

​
API keys

  • Public key — used on the client (browser SDK). Safe to expose.
  • Secret key — used on the server (API calls). Keep it secret.
  • Webhook secret — HMAC for webhooks.
Rotate keys periodically. Keep secrets in environment variables.