Live keys vs. public keys

There are two kinds of keys, and choosing the right one matters:

Live key (server)

Called Private key in the form. Used from your server or backend, where the key is never visible to the user. A live key can have full access and should be protected like a password.

Public key (pub)

Intended for the browser/frontend, where the code is visible. A public key has limited permissions (for example it can never call batch, statistics or replication) and must be locked to your own domains (origin allowlist) — without domains every call is rejected. This also stops others from abusing it.

Rule of thumb: If the key lives in code a user can see (a website or app), use a public key with domain restrictions. Otherwise use a live key on the server.