Skip to main content
Biqli has three application credential types. They are intentionally not interchangeable.

​
Publishable keys

Create a publishable key in Workspace settings -> Tracking. A publishable key can appear in HTML or a frontend bundle. Its authority is restricted to browser tracking and saved allowed-hostname rules. It cannot manage links, domains, members, or workspace settings. Before using it:
  1. Enable conversion tracking.
  2. Add the exact website hostname.
  3. Generate the key.
  4. Save the tracking configuration.
  5. Deploy the SDK and verify the public page.
If you rotate or revoke the key, the old key stops working immediately.

​
Mobile publishable keys

Workspace owners create and manage these keys in Workspace settings → Mobile Apps. The key identifies and rate-limits one registered app. It can resolve mobile opens but cannot manage workspace resources or read analytics. Use it only with its matching biq_mapp_... app ID. Key rotation activates a replacement while the prior key remains available only during the configured overlap period, allowing time to distribute a new app build.

​
Secret workspace API keys

Create a secret key in Workspace settings -> API Keys. For tracking alone, choose Restricted and grant Conversions -> Write. Store the key in a secret manager or server environment variable:
Never place a secret key in:
  • HTML or client JavaScript
  • a mobile application
  • a URL or query string
  • browser storage or cookies
  • source control, screenshots, or logs

​
Which key should I use?

Use the browser publishable key for approved website code, the mobile publishable key for a registered native app, and a secret API key only on a server you control.
A reverse proxy does not make a secret API key safe for browser use. Reverse proxies may forward only the browser tracking endpoints and must keep the publishable-key model.

​
Rotation checklist

  1. Create or generate the replacement credential.
  2. Deploy it to every intended application.
  3. Confirm a real test event succeeds.
  4. Revoke the old credential.
  5. Check logs for old-key failures.
Secret API keys do not expire automatically. They stop working when revoked, when their creator loses required workspace access, or when the workspace is deleted. Read API authentication for the full server permission model. Read Mobile security and privacy for app-scoped keys and signed attribution receipts.