API keys

A key lets your site, app, or server talk to FounderHQ. Each key does one job for one brand. About 1 minute to create one.

Settings → API Keys

Two kinds of key

	Publishable key	Secret key
Looks like	`fhq_pk_XXXX`	`fhq_sk_XXXX`
Where it goes	In your site or app	On your server only
If someone else sees it	Expected. It is built to be public.	Rotate it at once.

Never put a secret key in a web page or a mobile app.

Pick the key for the job

You want to	Choose	Kind
Track visitors and events on your site or app	Track your site or app	Publishable
Send events from your backend	Send events from your server	Secret
Show a Journey in your product	Show journeys on your site	Publishable
Add people to a sequence from your backend	Add people to sequences	Secret
Send one message from your backend	Send messages from your server	Secret

Create a key

Open Settings → API Keys and press New API key.
Pick what the key is for, from the table above.
Choose the Brand and give the key a Key name you will recognize later, such as "Marketing site".
For a publishable key, fill in Allowed origins: the addresses your pages are served from, one per line. FounderHQ refuses the key from a browser on any other address.
Press Create key.
Copy the key now. FounderHQ shows the full key only once.

Allowed origins

An origin is the scheme, the host, and the port, with no path:

https://your-domain.com
https://www.your-domain.com
http://localhost:3000

Origins are recommended for a website key and required for a Journey key. Mobile apps are not limited by this list.

Journey keys

A key that shows Journeys also has a Journey scope: all the brand's Journeys, including future ones, or only the Journeys you select.

Find a key later

The list groups keys by product. Each row shows the name, the kind, the brand, who created it, and when it was last used. The key itself is masked: you see its first and last characters only.

Never used on a key you already installed means no request has reached FounderHQ with it. Check that the key in your code matches.

Change, rotate, or delete a key

Action	What happens
Edit	Change the name, the allowed sites, or the Journeys it can show.
Rotate	You get a new key. The old one stops working at once.
Delete	The key stops working at once. This cannot be undone.

A key's brand and purpose cannot be changed. Create a new key for a different brand or job.

Rotate a secret key whenever it may have leaked. Put the new key in your server before you rotate if you can, or expect a short gap.

Owners and admins manage every key. A member manages the keys they created.

AI agent or LLM? Read this page as markdown