Keys
Every app has publishable and secret keys, Stripe-style. Manage them on the dashboard.
| Key | Prefix | Where it goes | Checked by |
|---|---|---|---|
| Publishable | vr_pk_test_ / vr_pk_live_ | Your web page or app. Public. | The SDK, at init() and every connect() |
| Secret | vr_sk_test_ / vr_sk_live_ | Your server only. Never in a page or app. | Velvet server APIs (none public in v1) |
Test and live
- Test keys are instant. You need a full (non-guest) Velvet account, to be 18 or older, to accept the terms, and to say in one line what you're building. One test app per account.
- Live keys are for public apps. Request them from the dashboard; we review each app by hand. Once approved, the app turns live and you create live keys from the Keys card.
Allowed origins
A publishable key only works where you allow it: up to 3 domains (example.com) or mobile app IDs (com.example.app). The browser's Origin is what's checked, so another site can't use your key. localhost always works for test keys.
Shown once
We store a hash of each key, plus its prefix and last four characters. The full key is shown once, when it's created. If you lose it, rotate it.
Rotate and revoke
- Rotate gives you a new key of the same kind. The old one keeps working for 24 hours, so you can deploy without downtime.
- Revoke stops a key at once. Apps that use it fail at their next
init()orconnect().
What the key check sends
The SDK sends your key, the SDK version and (from the browser) your page's origin. Nothing about your players. The reply is your app's status and limits:
{ "data": { "appId": "…", "environment": "test", "status": "active",
"limits": { "maxStrength": 100, "maxDurationMs": 60000 } } }
A suspended app gets status: "suspended", and the SDK refuses to run. An unknown, revoked or expired key gets 401 invalid_key.