API Keys

Each project has two types of API keys — a publishable key for client-side use and a secret key for server-side integrations. You manage both from Settings → API Keys in the dashboard.

Publishable Key

Prefixed with pk_live_, this key is created automatically with your project. It's safe to include in frontend code, embedded widgets, and public repositories.

Publishable keys can only perform viewer-facing operations:

• Creating viewer sessions
• Sending chat messages
• Accessing public event data

The full key is always visible in the dashboard with a copy button.

Secret Key

Prefixed with sk_live_, this key carries full API permissions — creating events, managing registrations, reading analytics, and more.

Secret keys are only shown once. When you generate or regenerate a key, the full value appears in a dialog. After you close it, only a masked preview (e.g. sk_live_oZXP••••••••) is visible.

Generating a Secret Key

If your project doesn't have a secret key yet:

1. Go to Settings → API Keys
2. Click Generate Secret Key
3. Copy the key from the dialog immediately
4. Store it securely (environment variable, secrets manager)

Regenerating a Secret Key

If you need to rotate your secret key:

1. Click Regenerate next to the existing key
2. Confirm in the dialog — this immediately revokes the old key
3. Copy the new key and update your integrations

Any requests using the old key will fail immediately after regeneration.

Security Best Practices

• Never expose secret keys in client-side code, public repos, or browser-accessible files
• Use environment variables to store secret keys in your backend
• Rotate keys if you suspect they've been compromised
• Use publishable keys for all client-side integrations (embedded widget, player)

Using Keys in the API

Include your key in the Authorization header:

curl https://api.keepem.io/v1/events \
  -H "Authorization: Bearer sk_live_your_key"

For the embedded widget, pass the publishable key as a data attribute:

<script
  src="https://cdn.keepem.io/assets/embed.min.js"
  data-event="evt_your_event_id"
  data-key="pk_live_your_key"
></script>

See API Authentication for full details on authenticating API requests.