API keys

Keys use the Bootstrapware prefix bsw_ with environment and type: bsw_test_pub_, bsw_live_pub_, bsw_test_sec_, bsw_live_sec_.

Publishable

Safe in the browser for loading published app config and (Hosted) conversation routes. You may expose them as NEXT_PUBLIC_... if you accept that exposure model.

• Live publishable config requires an active BYO ($9.99) or Hosted ($19.99) entitlement.
• Live Hosted writes require Hosted ($19.99).
• Test publishable keys work without a paid plan.

Secret

Server-only. Used as Authorization: Bearer for app create/draft/publish, usage, author-tokens, and MCP secret fallback. Never put secrets in NEXT_PUBLIC_ env vars or client bundles. Cookie sessions for the dashboard are not API keys.

Prefer OAuth Connect for Cursor when possible so mcp.json stays URL-only. See AGENTS.md.

Mint and revoke

Dashboard-only under Chat → Keys. Not available via MCP or a secret management API. If an agent needs a publishable key and env is empty, it must stop and ask a human. Revoke Cursor OAuth grants on the Keys page when a machine should lose access.

Trust boundary

A leaked publishable key plus forged author.id is a real risk. Mitigate with allowed origins, keep embeds behind your auth, and enable requireAuthorToken with a secret-minted authorToken when you need stronger Hosted write integrity. Details: Identity.

Related: Environments · API overview · AGENTS.md · Origins · Security