Biqli has two credential types. They are intentionally not interchangeable.
Publishable keys
Create a publishable key in Workspace settings -> Tracking.
A publishable key can appear in HTML or a frontend bundle. Its authority is restricted to browser tracking and saved allowed-hostname rules. It cannot manage links, domains, members, or workspace settings.
Before using it:
- Enable conversion tracking.
- Add the exact website hostname.
- Generate the key.
- Save the tracking configuration.
- Deploy the SDK and verify the public page.
If you rotate or revoke the key, the old key stops working immediately.
Secret workspace API keys
Create a secret key in Workspace settings -> API Keys. For tracking alone, choose Restricted and grant Conversions -> Write.
Store the key in a secret manager or server environment variable:
Never place a secret key in:
- HTML or client JavaScript
- a mobile application
- a URL or query string
- browser storage or cookies
- source control, screenshots, or logs
Which key should I use?
Use a publishable key when code runs on a visitor’s device. Use a secret API key when code runs on a server you control.
A reverse proxy does not make a secret API key safe for browser use. Reverse proxies may forward only the browser tracking endpoints and must keep the publishable-key model.
Rotation checklist
- Create or generate the replacement credential.
- Deploy it to every intended application.
- Confirm a real test event succeeds.
- Revoke the old credential.
- Check logs for old-key failures.
Secret API keys do not expire automatically. They stop working when revoked, when their creator loses required workspace access, or when the workspace is deleted.
Read API authentication for the full server permission model. 
