API keys
Choose the least access each integration needs. Keys bind one organization and one environment.
RESTRICTED KEY
RESTRICTED KEYS start with rk_test_ or rk_live_. Choose individual scopes or complete scope groups. They never inherit a newly introduced scope.
SECRET KEY (FULL ACCESS)
SECRET KEYS start with sk_test_ or sk_live_. They include every current and future server scope eligible for their environment. They never include authentication, billing, organization administration, or API-key lifecycle actions.
PUBLISHABLE KEY
Veltor creates one Test and one Live PUBLISHABLE KEY when the organization is created. Each stays unchanged for the organization’s lifetime and grants only observations:create. You can copy it for the browser SDK, but cannot create, edit, rotate, revoke, or delete it.
Store and revoke
Veltor shows each RESTRICTED KEY or SECRET KEY once and stores only its verifier. Keep these server keys in a secret store, never in source code, browser bundles, logs, URLs, or email. Revoke one in Developers when it is no longer needed.