Skip to main content
Publishable keys and secrets let your own applications authenticate with Statisfy — for example, to embed a Statisfy digital worker in your product or to call Statisfy’s data APIs. They come in a pair, following the same convention as Stripe and other platforms:
  • A publishable key (pk_live_…) — a public identifier for your workspace. It is safe to ship in client-side code. There is one publishable key per workspace.
  • A secret — a private signing/authentication credential, paired with the publishable key. Secrets are stored in Google Secret Manager and are never stored in plain text by Statisfy.
Managing these keys requires access to the API keys area of your workspace. If you don’t see it, ask your Statisfy administrator.

​
Accessing your keys

Open the API keys section of your workspace. You’ll see your publishable key, the controls to generate and rotate secrets, and a way to view an existing secret at any time.

​
Secret types

A workspace can hold one secret per type. Choose the type that matches how your app authenticates:
JWT secrets are the right choice for embedding a digital worker in your product. API secrets are for backend integrations that read or write Statisfy data programmatically.

​
Generating a secret

1

Pick a secret type

Select JWT or API in the API keys panel.
2

Generate

Click Generate. The first time you generate any secret, Statisfy also creates your workspace’s publishable key automatically.
3

Copy the values

Your publishable key and the new secret are shown. Copy the secret and store it somewhere safe (a secrets manager, environment variables, etc.).
A workspace holds one secret per type. If a secret of the selected type already exists, generating again is blocked — rotate it instead to get a fresh value.

​
Viewing a secret

You can view an existing secret at any time. In the API keys panel, choose the secret type and select View secret — Statisfy reads the current value securely from Google Secret Manager and displays it so you can copy it again.
Viewing a secret does not change it. Existing integrations keep working.

​
Rotating a secret

Rotating replaces a secret with a brand-new value.
1

Choose the type and rotate

Select the secret type and click Rotate, then confirm.
2

Update your apps

Copy the new secret and update every app or backend that uses it.
Rotation is a hard cutover. The old secret stops working immediately, so anything still using it — JWTs signed with the old secret, or API calls presenting it — will start failing until you update them. Plan rotations for a maintenance window, or update your apps right away.
Rotate a secret whenever you suspect it has been exposed (committed to source control, shared in a ticket, logged, etc.).

​
About the publishable key

  • It is public — safe to include in front-end code and client apps.
  • There is one per workspace, created automatically the first time you generate a secret.
  • It currently cannot be revoked or disabled from this screen. If you need to invalidate access, rotate the relevant secret instead — that immediately breaks anything signed with or presenting the old secret.

​
Using your keys

​
JWT (digital-worker SDK)

Your backend mints a short-lived JWT, signs it with your JWT secret using HS256, and your app sends it alongside the publishable key on each request:
The token should include standard claims (iat, exp) plus the end user’s email, which Statisfy uses to resolve who is making the request. Because the JWT is short-lived and minted by your backend, the long-lived secret never leaves your server.
Sign JWTs on your backend only. Never ship the JWT secret to a browser or mobile client — only the publishable key is safe to expose client-side.

​
API (data APIs)

For server-to-server integrations, your backend presents the API secret as the credential on each call to Statisfy’s data APIs, together with your publishable key. Keep the API secret on your server and never expose it in client-side code.

​
Security

  • Secrets are stored in Google Secret Manager, never as plain text in Statisfy’s database.
  • Each workspace’s keys are isolated — there is no cross-workspace access.
  • The publishable key is public; the secret is sensitive — treat it like a password.
  • Rotate a secret immediately if you believe it has leaked.

​
Frequently asked questions

The publishable key identifies your workspace and is safe to expose publicly. The secret is private and is used to sign JWTs or authenticate API calls. They are always used together.
Yes — use View secret to display the current value again. If you’d rather replace it entirely, Rotate generates a new one (which invalidates the old value).
Yes. A workspace can hold one secret of each type — one JWT and one API — and you generate, view, and rotate each independently.
They break until updated. Rotation is an immediate cutover: the old secret stops working the moment the new one is created, so update every app that uses it as part of the rotation.