Keys and domains

There are two keys and they are not interchangeable.

• pk_live_… goes in the page. It is readable by anybody who views the source, which is fine, because it only works on hosts you have listed.
• sk_live_… goes on a server. It is shown once, it is not tied to a domain, and it reads your requests and your usage.

The domain list

Add a host on the Embedding screen. The widget checks the Origin of the page it is running in against that list.

A widget on a host you have not listed gets a polite refusal rather than a broken page — and you get an email. That is deliberate: nine times out of ten the unlisted host is your own new shopfront, and a silent failure would leave somebody staring at an empty box on a landing page they just launched.

Subdomains are not implied. shop.example.com and example.com are two entries, because a wildcard is how a forgotten staging host ends up serving your catalogue.

Rotating a key

Rotating sk_ invalidates the old one immediately. Rotating pk_ gives the old key a 24-hour grace period, because it is baked into pages that may be cached in front of you.