> ## Documentation Index
> Fetch the complete documentation index at: https://learn.biq.li/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials

> Use publishable keys in browsers and secret workspace API keys on trusted servers.

Biqli has two credential types. They are intentionally not interchangeable.

| Credential     | Safe location       | Purpose                                                   |
| :------------- | :------------------ | :-------------------------------------------------------- |
| `biqli_pk_...` | Browser code        | Client tracking from saved allowed hostnames              |
| `biqli_...`    | Trusted server only | Workspace API operations allowed by the key's permissions |

## Publishable keys

Create a publishable key in **Workspace settings -> Tracking**.

A publishable key can appear in HTML or a frontend bundle. Its authority is restricted to browser tracking and saved allowed-hostname rules. It cannot manage links, domains, members, or workspace settings.

Before using it:

1. Enable conversion tracking.
2. Add the exact website hostname.
3. Generate the key.
4. Save the tracking configuration.
5. Deploy the SDK and verify the public page.

If you rotate or revoke the key, the old key stops working immediately.

## Secret workspace API keys

Create a secret key in **Workspace settings -> API Keys**. For tracking alone, choose **Restricted** and grant **Conversions -> Write**.

Store the key in a secret manager or server environment variable:

```bash theme={null}
BIQLI_API_KEY=biqli_xxxxxxxxxxxxxxxxxxxxxxxx
```

Never place a secret key in:

* HTML or client JavaScript
* a mobile application
* a URL or query string
* browser storage or cookies
* source control, screenshots, or logs

## Which key should I use?

Use a publishable key when code runs on a visitor's device. Use a secret API key when code runs on a server you control.

<Warning>
  A reverse proxy does not make a secret API key safe for browser use. Reverse proxies may forward only the browser tracking endpoints and must keep the publishable-key model.
</Warning>

## Rotation checklist

1. Create or generate the replacement credential.
2. Deploy it to every intended application.
3. Confirm a real test event succeeds.
4. Revoke the old credential.
5. Check logs for old-key failures.

Secret API keys do not expire automatically. They stop working when revoked, when their creator loses required workspace access, or when the workspace is deleted.

Read [API authentication](/docs/api-reference/authentication) for the full server permission model.