API keys

Mint Importer keys on https://app.bootstrapware.co/importer/keys. Publishable keys may appear in the browser. Secret keys stay in Route Handlers.

Publishable keys authenticate browser config and session metadata calls. Safe to expose as NEXT_PUBLIC_... if you accept that exposure model.
Secret keys are for server-side management automation. Never ship them to the browser. Use them as Bearer tokens against the importer management API to create, draft, and publish hosted importers.

Dashboard login uses a user session cookie, not a secret API key.