Skip to main content
The Risk Platform uses two kinds of keys, each with one job. Find them in Risk Platform > API Keys in the dashboard. These keys are separate from the API keys of Abstract’s other products, such as Email Reputation or IP Intelligence. A Risk Platform key doesn’t work on those APIs, and their keys don’t work on the Risk API.

​
Site key

The Site key is safe to ship in your frontend. It only collects device tokens, and only from the origins configured for it: a request from any other origin gets 401 with reason origin_not_allowed. The browser SDK sends it in the X-Site-Key header. To allow a web address, send each origin your signup and login pages run on, such as https://app.example.com, to support. Allowed origins apply to every Site key on your account.

​
Secret key

Secret keys start with sk_. Your backend sends the Secret key as a bearer token:
The server SDKs read it from the ABSTRACT_SECRET_KEY environment variable.
  • A Secret key is shown once, when you create it. Store it in your secret manager right away.
  • Give each key a label that names where it runs (for example “Production web”). You can have several and revoke each one on its own.
  • Never put it in browser code, a public environment variable, a URL, logs, analytics or a source map.
  • Revoking a Secret key stops API access immediately.

​
Test key

The public key sk_test_public_fixtures returns fixed test responses for testing your integration. It only works with a test fixture, is rate-limited, and never stores a check.