Key types
There are two kinds, and picking the right one matters.
Publishable — ig_pk_…
For browsers. Goes directly in your page source.
These are public by design. Anyone viewing your page can read the key, and that is expected — the same as a Google Maps JS key or a Stripe publishable key. What stops someone else using it is the origin allowlist.
- Requires at least one allowed origin
- Shown in full in your dashboard whenever you need it
- Safe to commit, safe to ship in a bundle
Secret — ig_sk_…
For servers and mobile apps — anything that does not send an Origin header,
which means the allowlist cannot protect it.
- Shown exactly once, at creation. We store an identifier, not the key. We cannot show it to you again because we do not have it.
- Rate limited per IP
- Treat like a password: environment variables or a secrets vault, never a repo
If you lose one, revoke it and create another. There is no recovery.
Which do I need?
| Calling from | Use |
|---|---|
| A web page | Publishable |
| A Node/Python/Go server | Secret |
| A mobile app | Secret |
| A serverless function | Secret |
| curl, for testing | Either — publishable works but is rate limited per IP |
Revocation
Revoking is permanent. It propagates within 30 seconds — the API keeps an in-memory snapshot rather than checking the database on every request, which is what makes it fast. If you are revoking because a key leaked, count those 30 seconds as part of the exposure.
Rotating without downtime
- Create the new key
- Deploy it alongside the old one
- Confirm traffic has moved (the dashboard shows per-key usage)
- Revoke the old key
Never revoke first. There is no grace period.