Appearance
Keys
You use three credentials. Each has one job.
| Credential | Where it goes | What it does |
|---|---|---|
| Public key | The browser: init({ publicKey }) | Shows tours, announcements, surveys, chat and the Help center to your visitors. Safe to share. |
| Secret key | Your own server only | Sends events from your backend (server events) and signs each user id for identity verification (userHash). |
| Agent token | Your AI tool | Lets Claude, ChatGPT, Cursor or another AI tool act for one person. Connecting through OAuth creates it for you. |
You find the Public key and the Secret key under Settings → Developers.
Public key
Anyone can read it in your page source, so it only grants access to content you already published. It starts with pk_. If it leaks, add your site under allowed origins so other websites cannot reuse it, or regenerate it (every embed then needs the new key).
Secret key
It starts with sk_. It belongs in your server environment, for example as JUSTONECX_SECRET_KEY. Never put it in client code, a mobile app or a public repository.
- The full key is shown once, when you generate it. We store it only encrypted and as a hash. After that the dashboard shows its first characters.
- One key does two jobs. It authenticates server-to-server event calls and it is the secret for
userHash. If you rotate it, your server must use the new key for both. - Rotating it invalidates the old key immediately, in both places.
- A leaked Secret key lets someone send fake events and forge user identities. Treat it like a password and rotate it if you think it leaked.
Workspaces created before 2026-10-17 also had a separate identity secret. It still works until you rotate your Secret key, and the dashboard shows a banner while it does. Rotating the Secret key retires it.
Agent token
An agent token is per person, not per workspace. It has the same permissions as the person who made it, narrowed to what you allow. The easiest way is to connect your AI tool through the MCP server and approve it in the browser (OAuth). See AI assistants.