Reference
Authentication
Choose the credential class for the request path, then keep server secrets and browser activation flows separate.
Key classes
Server Test Keys start with sk_test_ and are for non-billable Test/Sandbox requests. Server Production Dry-run Keys start with sk_dry_ and are for non-billable pre-live validation. Server Production Keys start with sk_live_ and are for approved live server traffic. Browser Publishable Keys start with pk_publishable_ and are only for browser activation.
Keep sk_test_, sk_dry_, and sk_live_ values on your server. Never place server secret keys in browser bundles, HTML, mobile apps, or public repositories.
Browser activation
A browser sends its pk_publishable_ key in the POST /v1/browser/activate request body together with an allowed Origin. A successful activation returns a short-lived activation_token bound to that project and origin.
Use the returned activation token for browser-authorized /v1 requests. Do not send the raw publishable key as Authorization for placements, jobs, decisions, beacons, consent, or project configuration.
Permissions and origins
Configure every local, staging, preview, and production browser origin on the publishable key in the dashboard. Activation rejects an Origin that is not configured for that key.
A valid server secret key or a valid browser activation token is required for the authenticated /v1 routes. The hosted renderer script and issued render-frame URLs do not use an Authorization header.
Need rollout review?
Start with the Server API. Use contact only when you need rollout review, enterprise coordination, or non-standard integration help.