API key security
How the Token and Secret credential pair is issued, stored, and rotated.
Every Environment (Production, Staging, and so on) issues its own credential pair, shown under Agent > Environments.
Token (arcy_pk_...): the public half. It's the only credential arcy.init() takes, the
only one an install snippet embeds, and it's safe to ship in client-side code and appear in
your page source by design.
Secret (arcy_sk_...): the server-side half. It exists solely to support identity
verification, revealed once at creation and never rendered in the dashboard again. Never put
it in front-end code, a build environment variable that reaches the browser, a mobile app
binary, or a repository.
Your Token alone can't drain your credit budget on its own: every session arcy.js bootstraps also has to come from a verified origin before ARCY will bill against it. See Domain verification & session trust for how that works.
Rotating a Token
Rotate a Token from Agent > Environments. The old value is revoked immediately: any page still loading with the previous Token stops authenticating and needs the new one redeployed.
Rotating a Secret
Rotating a Secret is safer to sequence: ARCY accepts signatures made with the previous Secret for 24 hours after a rotation, so a deploy carrying the new value can follow the rotation without sending your users anonymous in between. If the Secret leaked, don't wait for that window: revoke the previous Secret immediately from the same screen, and any signature still made with the old value stops verifying at once.
See Compliance at ARCY AI for certification status, DPA availability, and regulated-industry guidance.