API keys

Keys use the Bootstrapware prefix bsw_ with environment and type: bsw_test_pub_, bsw_live_pub_, bsw_test_sec_, bsw_live_sec_.

Publishable

Safe in the browser for loading published flow config and (Hosted) progress routes. You may expose them as NEXT_PUBLIC_... or VITE_... if you accept that exposure model.

  • Live publishable config requires an active BYO ($9.99) or Hosted ($19.99) entitlement.
  • Live Hosted progress writes require Hosted ($19.99) plus an authorToken from your BFF.
  • Test publishable keys work without a paid plan.

Secret

Server-only. Used as Authorization: Bearer for flow create/draft/publish, usage, author-tokens, and MCP secret fallback. Never put secrets in NEXT_PUBLIC_ env vars, client bundles, or MCP install snippets. Cookie sessions for the dashboard are not API keys.

Prefer OAuth Connect for Cursor when possible so mcp.json stays URL-only. See AGENTS.md.

Mint and revoke

Dashboard-only under Onboard → Keys. Not available via MCP or a secret management API. If an agent needs a publishable key and env is empty, it must stop and ask a human. Revoke Cursor OAuth grants on the Keys page when a machine should lose access.

Trust boundary

A leaked publishable key plus forged user.id is a real risk. Mitigate with allowed origins, keep embeds behind your auth, and enable requireAuthorToken with a secret-minted authorToken when you need stronger Hosted write integrity. Details: Identity.

Related: Environments · API overview · AGENTS.md · Origins · Security