API keys
Two key types, one rule: publishable keys read, secret keys write. Both live under Dashboard → Settings → API keys.
| Key | Prefix | Where it goes | Can do |
|---|---|---|---|
| Publishable | pk_live_… | Ship it in your app / client | Reads: check, subscribers, offerings |
| Secret | sk_live_… | Server / backend only | Everything, incl. writes: purchases, grant |
Never ship a secret key
The sk_ key can grant entitlements and record purchases. Keep it in server environment variables only. If a client calls a write endpoint with a pk_ key it gets 403 — that split is deliberate.
Using a key
Every request carries the key as a bearer token:
bash
Authorization: Bearer pk_live_xxxxxxxxxxxxxxxxxxxx # reads
Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxx # writes (server only)Shown once
A key's full value is displayed only when you create it — EntitleHub stores just a hash, so it can never show you the raw value again. Copy it into your secret manager immediately. Lost it? Revoke and create a new one.
Rotating & revoking
- Create a new key, deploy it, then revoke the old one — zero downtime.
- Revoking is immediate: the next request with that key gets
401. - Keep separate keys per surface (app vs. backend) so you can rotate one without touching the other.
For real purchases to validate, add your store credentials next: Store credentials.