Docs
Console: Sites & API keys
Create sites, add domains, and manage publishable and secret keys.
Sites
A site groups domains, purposes, keys and vault. The slug appears in API paths and is globally unique. A site is multi-domain: verified domains form the Origin allowlist for pk_ keys.
API keys
| Type | Prefix | Use | Scope |
|---|---|---|---|
| Publishable | pk_test_ / pk_live_ | Browser (SDK) | Write/read consent for the referenced subject. Origin-restricted. No admin. |
| Secret | sk_test_ / sk_live_ | Server | Full site scope. Create subjects, merge, history, DSAR. |
- The full key is shown once at creation.
- Rotate mints a replacement; the old key stays valid until you revoke it (grace window).
- Revoke invalidates the key immediately.
- A
pk_key with no Origin allowlist returns403— add a domain to the site first.
Leaked key? Revoke it here and check the Audit log and the vault timeline for writes attributed to that
apiKeyId. See Troubleshooting.