> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abstractapi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Keys

> The Risk Platform keys: the Site key for browser code and Secret keys for sending checks from your server.

The Risk Platform uses two kinds of keys, each with one job. Find them in **Risk Platform > API Keys** in the dashboard.

| Key | Where it goes | What it can do | What it can't do |
| - | - | - | - |
| Site key | Browser code | Collect device tokens from your allowed origins | Send checks, read data, change anything |
| Secret key | Your server only | Send checks, read integration health, report outcomes, read lists | Change policies or lists |

These keys are separate from the API keys of Abstract's other products, such as Email Reputation or IP Intelligence. A Risk Platform key doesn't work on those APIs, and their keys don't work on the Risk API.

## Site key

The Site key is safe to ship in your frontend. It only collects device tokens, and only from the origins configured for it: a request from any other origin gets `401` with reason `origin_not_allowed`. The browser SDK sends it in the `X-Site-Key` header.

To allow a web address, send each origin your signup and login pages run on, such as `https://app.example.com`, to [support](mailto:support@abstractapi.com). Allowed origins apply to every Site key on your account.

## Secret key

Secret keys start with `sk_`. Your backend sends the Secret key as a bearer token:

```http theme={null}
Authorization: Bearer sk_...
```

The server SDKs read it from the `ABSTRACT_SECRET_KEY` environment variable.

* A Secret key is shown once, when you create it. Store it in your secret manager right away.
* Give each key a label that names where it runs (for example "Production web"). You can have several and revoke each one on its own.
* Never put it in browser code, a public environment variable, a URL, logs, analytics or a source map.
* Revoking a Secret key stops API access immediately.

## Test key

The public key `sk_test_public_fixtures` returns fixed test responses for [testing your integration](https://docs.abstractapi.com/api/risk-platform/quickstart.md#3-test-without-live-data). It only works with a test fixture, is rate-limited, and never stores a check.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.