Core Concepts
Publishable keys
Browser SDK credentials (pk_live_…), hash storage, allowlist, rotation.
Publishable keys
What it is
A publishable key (pk_live_…) authenticates the browser SDK to public SDK routes. It is not an operator session token and not a connector secret.
Why it exists
The SDK must load published consent config and post receipts without embedding operator credentials.
Lifecycle
- Owner/Admin creates a key under project Develop (capability-gated create/revoke for Owner where documented).
- Raw key shown once; server stores a hash.
- SDK sends
Authorization: Bearer pk_live_…(prefer Bearer over?key=query, which may appear in logs). - Revoke soft-disables the key (
revokedAt).
Allowed origins
New projects enable the host allowlist by default. If enabled, SDK config/consent reject non-listed origins (origin_not_allowed). Add localhost and production hosts under Develop → Allowed origins.
Security properties
| Property | Behaviour |
|---|---|
| Storage | Hash at rest; raw key not recoverable later |
| Scope | Project-bound published consent + receipt post |
| Abuse controls | Rate limits on SDK routes; origin allowlist |