Authentication & Keys
Use publishable keys, secret keys, CORS, and user access with the right trust boundary.
Authentication & Keys
Use this page before connecting a project, server, vendor, or AI agent to a workspace.
Key Types
| Credential | Use for | Keep out of |
|---|---|---|
| Publishable Key | browser-safe reads from approved origins | privileged writes |
| Secret Key | server-side writes and privileged workflows | browser code, logs, screenshots, commits |
| user access | human-scoped Console and OAuth actions | shared team automation |
| MCP access | approved AI-agent inspection or setup | broad unattended changes |
CORS And Origins
- Add only the browser origins that should read workspace data.
- Treat staging, preview, and production origins as separate approvals.
- Remove old origins after domain changes or vendor offboarding.
Server Boundary
- Put privileged work behind a trusted server route, server action, worker, or backend service.
- Load Secret Key values from environment storage, not from checked-in code.
- Rotate Secret Key ownership when the operator changes.
If a credential is unclear, stop and return to Integrations & Keys before implementation continues.