> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryorato.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Create public keys for the website widget and secret keys for server-side access, and keep them secure.

Manage keys in **Developer → API Keys**.

![API Keys tab](https://mintcdn.com/oratoinc/4kqJqYTkP_RSjHT3/images/app/developer-api-keys.png?fit=max\&auto=format\&n=4kqJqYTkP_RSjHT3\&q=85\&s=98821bafd2df67bbcb6a5f1c5a15665f)

## Key types

| Type | Prefix | Use for | Restrictions |
| - | - | - | - |
| **Public key** | `pk_live_` | Frontend and the website widget | Works only on the domains you whitelist |
| **Secret key** | `sk_live_` | Backend and server use | Full API access. Never expose it in a browser or app. |

## Create a key

**1. Click Create API Key**

In **Developer → API Keys**, click **+ Create API Key**.

![Create New API Key dialog](https://mintcdn.com/oratoinc/4kqJqYTkP_RSjHT3/images/app/developer-create-key.png?fit=max\&auto=format\&n=4kqJqYTkP_RSjHT3\&q=85\&s=faf57574a2c1724c49d69c6d0463037f)

**2. Choose the key type**

Select **Public Key** or **Secret Key**.

**3. Name it**

Enter a **Key Name** that describes its use, for example `Marketing website` or `CRM sync`.

**4. Add allowed websites (public keys)**

Enter each domain where the widget will run, for example `example.com`, and click **Add**. At least one domain is required, or the widget won't load.

**5. Generate and copy**

Click **Generate API Key** and copy the key right away.

> [!WARNING]
>
> You can see the full key only once. Store it in a password manager or secrets vault. If you lose it, create a new key.

## Manage keys

The table lists each key's **Name**, **Key preview**, **Allowed domains**, **Usage**, and **Created** date, with actions to manage it.

## Security best practices

* Never commit keys to version control or share them in chat or email.
* Use public keys only in browsers. Use secret keys only on servers.
* Whitelist only the domains you control, including staging if you test there.
* Create separate keys per site or service, so you can revoke one without affecting others.
* Revoke keys you no longer use.

> [!NOTE]
>
> Only workspace Owners and Admins can manage API keys. See [Team and roles](https://docs.tryorato.com/account/team-and-roles.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.