SDK & API keys
SDK & API keys in the Workspace area (Admin) — route /workspace/sdk-api-keys.
SDK & API keys lives in the Workspace area of the dashboard, under Admin.
At a glance#
| Dashboard route | /workspace/sdk-api-keys |
| Area | Workspace (workspace) |
| Group | Admin |
| Platforms | Available for every app platform. |
What it does#
Issues and rotates the credentials each app environment uses. Every environment gets its own pair, which is what keeps development traffic out of production data.
The two keys are not interchangeable#
| Prefix | Ship in an app binary? | |
|---|---|---|
| Client key | skb_test_ck_ · skb_staging_ck_ · skb_live_ck_ | Yes — that is its purpose |
| Secret key | skb_{env}_sk_ | Never |
The environment prefix exists so a key visibly declares its blast radius. If you are unsure
which environment a key belongs to, read the prefix rather than inferring it from where you
found it. Keys issued before the prefixed scheme (scalebun_ck_…) remain valid.
Workflow#
Create per environment, not per developer
Keys identify an environment, not a person. Issuing one each makes rotation impossible to reason about.
Copy the secret to your secret manager now
This is the only moment it is visible.
Rotate on a schedule, and on every departure
Rotation is cheap; discovering a leaked key in a public repository is not.
Rotating without downtime#
Create the new key first, deploy it, confirm traffic arrives under it, and only then revoke the old one. Revoking first causes an outage for every client still holding the old key — including app versions already installed on devices you do not control.
Where the data comes from#
Client keys are safe in an app binary; secret keys are shown once and are server-side only.
From the SDK
Served by
SDK keys
Related#
Quick start — where these values go.
API conventions — how each key authenticates.
Audit log — who rotated what, and when.