# API keys

> Every store has two keys. One is public and goes in your pages. The other is secret and stays on your server.

This is one page of the Antiro docs (https://docs.antiro.io/api-keys). Every page in one file: https://docs.antiro.io/llms-full.txt

## The two keys

Find both on the [API keys](https://dashboard.antiro.io/dashboard/api-keys) page of the dashboard.

|  | Publishable key | Secret key |
| --- | --- | --- |
| Starts with | `pk_` | `bf_` |
| Used by | The browser SDK | The server API |
| Goes in | Your pages, as `data-key` | Your server, as `X-API-Key` |
| Visible to visitors | Yes, and that is safe | Never |

**Where each key goes**

```bash
# in the page: public
data-key="pk_xxxxx"

# on your server only: .env
ANTIRO_SECRET_KEY=bf_xxxxx
```

> **Keep the secret key on your server**
>
> Never put it in a page, or in any JavaScript file that reaches the browser. Anyone who has it can send requests to Antiro as your store.

## Allowed domains

The publishable key works on your store’s domain and its subdomains. The API keys page shows the allowed domains of each store.

From any other domain, Antiro refuses the script’s requests. The page keeps working, but it is not protected.

## Replace a key

**Secret key.** It is shown once, when it is created. Creating a new one is the only way to see a secret key again, and the old key stops working within a minute, so update your server right away.

**Publishable key.** Creating a new one replaces the old one, so update `data-key` in your pages.