Public & secret keys
What each site key is for and where it belongs.
Every site you add to NudgeVisor is issued two API keys automatically: a public key and a secret key. They serve very different purposes — one identifies your site in the browser, the other authenticates your servers — and treating them correctly is the difference between a safe integration and a leaked credential.
Two keys per site
A key always belongs to a single site. Any data captured with a site's public key is attributed to that site, so the keys are how NudgeVisor knows which site a browser session or a server request relates to. When you create a site, both keys are generated for you — there is nothing to set up by hand.
The public key
The public key is the one embedded in your widget install snippet. Because the snippet runs in the browser, the public key is visible in your page source by design — that is expected and safe. It is not a secret: it only names which site the browser data belongs to and grants no access to your account or your data.
You do not normally copy the public key by hand. The snippet shown in the dashboard already has it baked in — see Installing the widget and The install snippet for where it goes.
The secret key
The secret key is a server credential. It is used for server-to-server calls, where your own backend talks to NudgeVisor directly rather than through a visitor's browser. Unlike the public key, it must be kept private.
- Never place the secret key in client-side code, HTML, or anything a browser can download.
- Never commit it to a public repository. Store it in an environment variable or a secrets manager.
- Only share it with services you trust and control.
The simple rule: the public key is a client-side identifier, the secret key is a server credential.
If a secret key is exposed
If you suspect a secret key has leaked — for example it was pushed to a public repo or pasted into client-side code — treat it as compromised and rotate it. Open the site in the dashboard and regenerate the secret key. The old value stops working immediately, so update the new value everywhere your servers use it. The public key is unaffected and your widget keeps running.
Finding your keys
Both keys are shown on the site's page in the dashboard. Open the site you want, and you will find its public key and secret key listed there, ready to copy. If you manage several sites, double-check you are on the right one — keys are never shared between sites.