API keys
Every store has two keys. One is public and goes in your pages. The other is secret and stays on your server.
On this page
The two keys#
Find both on the API keys page of the dashboard.
| Publishable key | Secret key | |
|---|---|---|
| Starts with | pk_ | bf_ |
| Used by | The browser SDK | The server API |
| Goes in | Your pages, as data-key | Your server, as X-API-Key |
| Visible to visitors | Yes, and that is safe | Never |
# in the page: public
data-key="pk_xxxxx"
# on your server only: .env
ANTIRO_SECRET_KEY=bf_xxxxxAllowed domains#
The publishable key works on your store’s domain and its subdomains. The API keys page shows the allowed domains of each store.
From any other domain, Antiro refuses the script’s requests. The page keeps working, but it is not protected.
Replace a key#
Secret key. It is shown once, when it is created. Creating a new one is the only way to see a secret key again, and the old key stops working within a minute, so update your server right away.
Publishable key. Creating a new one replaces the old one, so update data-key in your pages.