# Two keys per website, for two different places.

> Virent's publishable browser key and server secret - where each belongs, how to reveal and rotate the secret, and how to keep it out of client code.

Canonical: https://virent.app/docs/workspace/keys
Last updated: 2026-10-19

The publishable key goes in browser code. The server secret goes only in your server's environment. Both are in Settings → Connection.

## The two keys

| | Publishable key | Server secret |
| --- | --- | --- |
| Prefix | `vha_pk_` | `vha_sk_` |
| Used by | Browser script and browser SDK | Server, edge, middleware and log integrations (hosting integrations call it the **Connection secret**) |
| Where it lives | Your page's HTML or browser bundle | Server environment variables or your host's secret store |
| Can be public | Yes; it only accepts events from your website's allowed origins | Never |
| Shown in the dashboard | In the copyable install snippets and prompt | Once, after you rotate it (**Rotate + reveal**) |

Each website also has a **site ID** (`VIRENT_SITE_ID`), used with the server secret. It is not a secret.

## Keep the server secret safe

- Store it as `VIRENT_INGEST_SECRET` in server environment variables.
- Never put it in variables your framework exposes to the browser, such as `NEXT_PUBLIC_`, `VITE_`, `PUBLIC_` or `NUXT_PUBLIC_`.
- Never commit it, paste it into a public chat, or include it in a screenshot or support request.
- Never use the masked preview (`vha_sk_••••`) as the value. It is not the secret.

## Rotate the server secret

Open **Settings → Connection** and choose **Rotate + reveal** next to **Server secret**.

1. Copy the new secret immediately: Secrets are shown once after rotation.
2. Update every install: Replace `VIRENT_INGEST_SECRET` wherever the old secret was used, and redeploy.
3. Verify: Refresh the installation status and confirm crawler events still arrive.

Rotating stops the old secret at once. Installs that still use it stop sending crawler data until you update them.

## If a secret leaks

Rotate it right away, update your installs, then remove the old value from wherever it leaked (repository history, logs, shared documents). Rotation is what makes the leaked value useless.