Dashboard · Configuration
API keys
Public key, secret, allowed origins, and rotation.
Keys, allowed origins, and your sites.
Two keys, not interchangeable#
| Key | Where | Protected by |
|---|---|---|
Public (pk_live_…) | Page source, visible by design | The origin allowlist |
Secret (sk_live_…) | Server-side only | Secrecy |
The public key is not a credential. It is in every page that runs the SDK. What stops someone else using it is the origin allowlist, not hiding it.
The secret is shown once, at creation. It is stored as a SHA-256 hash, so nobody can read it back: including us. Lost means rotate.
The origin list#
The collector refuses a visit arriving from an origin not on the list. A wildcard port is supported: http://localhost:*.
This is what protects the public key, so declare it accurately and narrowly.
The site's favicon#
The dashboard fetches the favicon from the site's own allowed origin and shows it beside the name. When it cannot, it shows a named status (none found, unreachable, unsupported) rather than a blank, so "never asked" stays different from "asked, has none".
Rotating#
Rotating the secret mints a new value and invalidates the old one immediately. Update your backend before rotating, not after.
Where sites come from#
Sites created here live in the database and are yours to manage. There may also be sites the operations team configured on the server, those appear but cannot be edited here. See Workspaces and sites.