API keys

Publishable keys may appear in the browser. Secret keys stay on your server. Prefixes are bsw_test_pub_, bsw_live_pub_, bsw_test_sec_, and bsw_live_sec_.

  • Content routes and GET /api/v1/config/:appId use the publishable key as Authorization: Bearer.
  • App management, POST /api/v1/author-tokens, purge, export, and usage use the secret key.
  • The SSE query carries the publishable key as key because EventSource cannot set a header. Never put the secret in that query.

ensure_comment_test_publishable returns the full bsw_test_pub_… value and envLine every time. Put that line in .env.local as NEXT_PUBLIC_BSW_COMMENTS_PUBLISHABLE_KEY. It does not mint live or secret keys. Those stay on Comments → Keys. Paste a secret into BSW_COMMENTS_SECRET on the server. Do not prefix it with NEXT_PUBLIC_ and do not commit it.

A missing or bad API key is 401 invalid_key. The publishable key identifies the workspace and environment. It does not identify the end user. Pair it with an author token. See identity.

Related: Environments · Origins · Cursor guide