Public and Secret keys
Platform keys
Every new project receives a Public key and a Secret key when the project is created. Existing projects that were migrated from the single API token model also receive both keys alongside any Legacy credential.
Public key (pf_pk_)
Use the Public key in Flutter SDKs, mobile apps, and other environments that run on an end-user device. It may perform identity actions only:
- Register and update devices
- Create and update subscribers
- Create, update, and remove subscriber tags
It cannot send push notifications, send email, or create workflow executions—even if a scope string is mistakenly assigned. That ceiling is enforced server-side.
Example
Secret key (pf_sk_)
Use the Secret key only on trusted servers. It authenticates privileged API calls such as batch push, batch email, and workflow execution creation, within the scopes assigned to that key.
Never embed a Secret key in a client app, public repository, or frontend bundle.
Example
Rotate
Platform keys are rotated, not deleted. Rotate issues a new key material, shows the plaintext once, and revokes the previous key. Update every service that still uses the old value before or immediately after you rotate.
- Open Developers → API keys.
- Choose Rotate on the Public or Secret platform key.
- Copy the new value from the modal. You will not see it again.
- Update your SDK config or server secrets, then redeploy.