Developer docs
Write keys
The browser may hold a publishable collect key. Secrets stay in Developers, in CI, in the webhook receiver — never in a theme file you paste on the internet.
Two kinds
| Key | Where | Job |
|---|---|---|
| pk_live_… | Snippet, GTM, NEXT_PUBLIC_… | Collect and decide. Rate-limited. Rotatable. |
| sk_live_… | Server, webhook ingest | Secret. Treat it like a password. |
Rotate
- Developers → create a new publishable key.
- Ship the theme / env with the new pk_live.
- Revoke the old one after traffic moves. Tracking Health should keep ticking.
The workspace id is never an auth factor from the client. Country headers are telemetry. Visitor IP is a rate-limit bucket, not a login.
