The key hierarchy

Three namespaces

The namespaces are deliberately disjoint so a leaked value is instantly identifiable as what it is. A platform key in a website is a configuration bug the format makes visible at a glance.

Kinds and environments

• secret — server-side only, full access to the granted surface. Constructing a browser client with one throws immediately, and so does putting one in a NEXT_PUBLIC_* variable.
• public — browser-safe: read-only (site public keys additionally may submit leads and forms — visitor input by nature), and useless without a matching allowed origin.
• live / test — test-environment keys skip origin/TLS checks for local development; nothing else is relaxed.

Shown once, stored hashed

Key values are minted with 32 bytes of entropy and shown exactly once. Storage is a SHA-256 hash (every lookup goes through it — the plaintext is never used in a query) plus an encrypted copy that superadmins can re-reveal only behind a verified sensitive-operation check, with the reveal landing in the audit log. Dashboards display keys masked to their last four characters.

Revocation and blast radius

• Revoking a key deactivates it on its next request.
• Site keys hang off their website record — deleting the site deletes its keys; revoking one client site touches nothing else.
• Suspending the platform kills every key at once. Data stays put.
• Keys track last_used_at and a request counter (updated atomically), so a dead key is visibly dead before you revoke it.