API keys

Publishable keys authenticate browser config and session metadata calls. Safe to expose as NEXT_PUBLIC_... if you accept that exposure model.
Secret keys are for server-side management automation. Never ship them to the browser. Use them as Bearer tokens against the importer management API to create, draft, and publish hosted importers.

Dashboard login uses a user session cookie, not a secret API key.