SDK & Admin API Keys
Which Encatch key to use where. Publishable SDK keys for client apps, admin API keys for your backend.
Encatch uses two kinds of keys. Each is created per project under Settings → Security, and each works only with its own set of endpoints.
Publishable SDK Keys
For the Web and Mobile SDKs running in your app. Safe to embed in client code.
Admin API Keys
For server-to-server calls from your backend. Secret, never expose them on a client.
Which key should I use?
| Publishable SDK key | Admin API key | |
|---|---|---|
| Use it for | Showing feedback forms and collecting responses through the Web SDK and Mobile SDKs | Server-to-server calls to the Admin API, such as identifying users from your backend |
| Where it lives | In your website or mobile app | On your server only |
| Safe in client code | Yes, restricted by allowed domains and packages | No, it is a secret credential |
| Works with | SDK endpoints | Admin API routes only |
| Rate limits | SDK rate limits | Admin API rate limits |
| Manage it | Publishable SDK Keys | Admin API Keys |
Using the wrong key type returns 403: a publishable key on an admin route, or an admin key on an SDK route.
Next steps
- Installing the SDK? Create a publishable key, then follow the Web SDK or Mobile SDK guide.
- Calling Encatch from your backend? Create an admin key, then see Identify User and the other Admin API endpoint pages in the sidebar.
- Testing before launch? Read about the Sandbox Environment and its rate limits.
Was this page helpful?