API Key Security
Best practices for storing and rotating API keys.
Updated
On this page
Key Types
| Prefix | Access Level | Safe for Browser? |
|---|---|---|
pk_* | Read-only storefront | Yes |
sk_* | Full admin access | No — server only |
Best practices for storing and rotating API keys.
Updated
| Prefix | Access Level | Safe for Browser? |
|---|---|---|
pk_* | Read-only storefront | Yes |
sk_* | Full admin access | No — server only |
NEXT_PUBLIC_ prefix only for the public key.env.local to version controlsk_* keys in browser environments. If you accidentally use a secret key client-side, the SDK will throw an error.