API key security
What the Token and the Secret each do, where each may live, and why the Token alone cannot spend your AI credits.
Each of a Product's two environments issues its own credential pair. The Token is already in the code on Installation; replacing either credential, and what breaks when you do, is on API Keys.
Token (pk_live_... or pk_test_... for the two environments a Product starts with, arcy_pk_... once you replace one) is the public half and is designed to appear in your page source.
Secret (sk_live_..., sk_test_... or arcy_sk_..., matching its Token) is the server-side half. It exists only to sign identity verification from your backend, and it must never reach front-end code, a build variable the browser can read, a mobile binary or a repository. Where each is shown, and what replacing one breaks, is on API Keys.
Why a leaked Token does not spend your credits
A Token in a page source is expected. Before ARCY charges a chat answer to your AI credits, the session that requested it has to have started from a Site under a Domain you verified. How that check works is on Session security.
Questionnaire answers
- Secrets are stored encrypted at rest and are never returned to a browser or written to a log in plaintext.
- Either credential can be replaced from the dashboard at any time. The consequences of each replacement are on API Keys.
- Certification and audit status is on Certification status.