Skip to main content
The workspace publishable key authorizes client-side conversion tracking. It is separate from workspace API keys and can be placed in approved website code because its access is limited to conversion collection. Add every website origin that is allowed to use the key. When an allowlist exists, Biqli checks the request origin against it. Use exact production domains and add development origins only while testing. Reset the key if it is being used somewhere you no longer control. A reset invalidates the previous value, so update every legitimate integration afterward.
Never expose a workspace API key in a website, mobile application, or public repository.

​
Create and configure the key

Open the workspace conversion or developer settings and generate the publishable key if one does not exist. Copy it into the client-side conversion integration, then add every exact website origin that is allowed to send events. An origin includes the scheme, hostname, and port when applicable. Production and local development origins are different. Avoid broad entries when a precise origin is possible.

​
Reset safely

  1. Identify every site using the current value.
  2. Generate the replacement through the reset action.
  3. Update each legitimate integration.
  4. Test a conversion from an allowed origin.
  5. Remove obsolete allowed domains.
The previous value stops working after reset. Client-side deployments that still contain it will fail until updated. The publishable key does not authorize workspace resource management. Use a separately scoped workspace API key from a trusted server for public API operations.