Authentication & Keys
Use publishable keys, secret keys, CORS, and user access with the right trust boundary.
Authentication & Keys
Use this page before connecting a project, server, vendor, or AI agent to a workspace.
Key Types
| Credential | Use for | Keep out of |
|---|---|---|
| Publishable Key | public reads and capability/customer-authorized operations; paired with a Secret Key for Agent CLI 0.20.1 in trusted shells | privileged writes |
| Secret Key | server-side SDK writes; Agent CLI in trusted shells | browser code, command arguments, logs, screenshots, commits |
| user access | human-scoped Console, OAuth, and Human CLI actions | shared agent automation |
| MCP OAuth access | hosted, shell-less discovery through three read-only tools | collection CRUD or commerce workflows |
The greenfield app creator keeps user and application identities separate. Its
browser authorization may issue one development-purpose sk01_ only after the
secret-free scaffold is installed; a Human CLI pat01_ is never valid app
environment input. Production service credentials remain an explicit Console
operation, not a scaffolder option.
CORS And Origins
- Add only the browser origins that should read workspace data.
- Treat staging, preview, and production origins as separate approvals.
- Remove old origins after domain changes or vendor offboarding.
Server Boundary
- Put privileged work behind a trusted server route, server action, worker, or backend service.
- Load Secret Key values from environment storage, not from checked-in code.
- For Agent CLI automation, prefer
SOFTWARE_PUBLISHABLE_KEYandSOFTWARE_SECRET_KEY; do not pass secrets as command arguments. - Rotate Secret Key ownership when the operator changes.
If a credential is unclear, stop and return to Integrations & Keys before implementation continues.
Customer sessions
Customer access/refresh tokens identify an end user, not a Console operator or a server credential. New apps use hosted OAuth/PKCE with an enabled registered client, exact origin/redirect, state validation and a trusted server token store. Keep tokens in HttpOnly cookies or a server-owned session; never browser JavaScript or localStorage. Browser API origins and hosted OAuth origins/redirects are separate registrations. Follow the Customers guide for me() readback, rotation and logout; Customers SDK describes the method boundaries.
A publishable key resolves the workspace and admits public reads plus specifically capability/customer-authorized operations. It does not authorize arbitrary writes. Secret keys and pat01_ operator credentials stay in trusted environments; PATs are not application service keys.