Publishable vs secret keys

Publishable keys (gk_live_pk_…) are safe to ship in a browser but MUST be restricted to your origins. Secret keys (gk_live_sk_…) are server-side only and never exposed.

Restricting a publishable key

Add your origins to the key’s allow-list. Requests from anywhere else are rejected at the edge.

Origin: https://yourapp.com  ✓
Origin: https://evil.example  ✗ 403