Every credential says what it is for and refuses everything else. Public keys work only from origins you list, secret keys refuse to work from a browser, and every member of your team sees only what their role needs.
Each key belongs to one environment and one data region, and says both in its prefix.
Safe in a page, useless anywhere else.
Used by the browser and mobile SDKs. In a browser a public key must arrive from an origin on its list, and a key with an empty list refuses everything rather than allowing anything.
For your backend, refused from a browser.
Read stored events and act as a trusted proxy. A secret key that arrives with a browser Origin is refused, so a key pasted into front-end code stops working instead of leaking.
The secret is shown one time.
A key’s secret is shown at the moment it is issued and never again; afterwards the console shows only its last four characters. Keys can be revoked at any time, and can be issued with an expiry through the API.
Every organisation has exactly one owner. Everyone else is invited with the role their work needs.
| Can | Owner | Admin | Developer | Billing |
|---|---|---|---|---|
| Issue and revoke SDK keys | Yes | Yes | Yes | No |
| Manage webhook endpoints | Yes | Yes | Yes | No |
| Change risk weights | Yes | Yes | No | No |
| Invite members and change roles | Yes | Yes | No | No |
| Payment methods and top-ups | Yes | Yes | No | Yes |
| Transfer the organisation | Yes | No | No | No |
Invitations are sent for the admin, developer and billing roles. Ownership can only be transferred.
Test traffic never mixes with production, and nothing you register can be pointed somewhere it should not go.
Development, staging and production keys are separate. Only production is billed, and every dashboard filters by environment.
Test environmentsEndpoints must use HTTPS and resolve to public addresses. Each has its own signing secret, shown once.
WebhooksA first-party proxy authenticates with its own credential, and only a trusted caller may forward a visitor’s address.
Proxy integrationsStart with the signals, keep your own decisions, and pay only for what you identify. No credit card needed.