# API keys (https://www.getfounderhq.com/docs/account/api-keys)

A key lets your site, app, or server talk to FounderHQ. Each key does one
job for one brand. About 1 minute to create one.

[Settings → API Keys](https://app.getfounderhq.com/?openSettings=api-keys)

## Two kinds of key

| | Publishable key | Secret key |
| --- | --- | --- |
| Looks like | `fhq_pk_XXXX` | `fhq_sk_XXXX` |
| Where it goes | In your site or app | On your server only |
| If someone else sees it | Expected. It is built to be public. | Rotate it at once. |

Never put a secret key in a web page or a mobile app.

## Pick the key for the job

| You want to | Choose | Kind |
| --- | --- | --- |
| Track visitors and events on your site or app | **Track your site or app** | Publishable |
| Send events from your backend | **Send events from your server** | Secret |
| Show a Journey in your product | **Show journeys on your site** | Publishable |
| Add people to a sequence from your backend | **Add people to sequences** | Secret |
| Send one message from your backend | **Send messages from your server** | Secret |

## Create a key

1. Open [Settings → API Keys](https://app.getfounderhq.com/?openSettings=api-keys) and press **New API key**.
2. Pick what the key is for, from the table above.
3. Choose the **Brand** and give the key a **Key name** you will
   recognize later, such as "Marketing site".
4. For a publishable key, fill in **Allowed origins**: the addresses your
   pages are served from, one per line. FounderHQ refuses the key from a
   browser on any other address.
5. Press **Create key**.
6. Copy the key now. FounderHQ shows the full key only once.

### Allowed origins

An origin is the scheme, the host, and the port, with no path:

```
https://your-domain.com
https://www.your-domain.com
http://localhost:3000
```

Origins are recommended for a website key and required for a Journey key.
Mobile apps are not limited by this list.

### Journey keys

A key that shows Journeys also has a **Journey scope**: all the brand's
Journeys, including future ones, or only the Journeys you select.

## Find a key later

The list groups keys by product. Each row shows the name, the kind, the
brand, who created it, and when it was last used. The key itself is
masked: you see its first and last characters only.

**Never used** on a key you already installed means no request has reached
FounderHQ with it. Check that the key in your code matches.

## Change, rotate, or delete a key

| Action | What happens |
| --- | --- |
| **Edit** | Change the name, the allowed sites, or the Journeys it can show. |
| **Rotate** | You get a new key. The old one stops working at once. |
| **Delete** | The key stops working at once. This cannot be undone. |

A key's brand and purpose cannot be changed. Create a new key for a
different brand or job.

Rotate a secret key whenever it may have leaked. Put the new key in your
server before you rotate if you can, or expect a short gap.

Owners and admins manage every key. A member manages the keys they
created.