API keys and allowed sites
Your website identifies itself to CustomerCatalyst with a public key. Manage keys under Settings › API keys (organization admins).
Public keys
Section titled “Public keys”A public key starts with pk_. It goes into your website’s code, so anyone can see it. That is fine: it can only send usage events and open the widgets, and only on the sites you allow. Keys never expire on their own; they work until you roll or revoke them.
Each key shows its name, the full key (you can copy it again any time), its abilities, its sites, when it was last used and its status: Active, or Closes … after a roll.
Abilities
Section titled “Abilities”Pick at least one when you create a key:
| Ability | Lets the key |
|---|---|
| Usage tracking | Send usage events from your product. |
| Messenger | Open the Messenger widget. |
| Support form | Open the support form. |
One key may have all three. Messenger and the form always use the same key, chosen on the Messenger or Form tab of Support settings.
Allowed sites
Section titled “Allowed sites”Every key needs at least one site. The key works only on pages from these sites:
- An exact site:
example.com,shop.example.com, orlocalhost:3000for testing. It must match exactly:example.comdoes not allowwww.example.comorexample.com:8080. - A wildcard:
*.example.comallows every subdomain (www.example.com,help.example.com), on any port, but notexample.comitself. Add both if you need both.
Paste a full address if you like: https://example.com/contact is saved as example.com. Wildcards on shared hosting addresses (like *.vercel.app or *.github.io) are refused, because they would allow other people’s sites too.
A key with no sites works nowhere. If a page isn’t on the list, Messenger and the form simply don’t show there.
Seen on sites not on the list
Section titled “Seen on sites not on the list”When a key is used on a site that isn’t on its list, the site appears under “Seen on sites not on the list:” with an Add button. Add it only if it is yours.
You can edit a key’s name and sites any time with Edit. On the Support settings tabs, Edit websites and Add websites take you to the same place.
Roll a key
Section titled “Roll a key”Roll creates a new key with the same name, abilities and sites. Put the new key in your site’s code, then let the old one close. Choose when the old key closes:
- Now
- In 24 hours (default)
- In 7 days
Until then, both keys work. Replace the old key in your site’s code (data-key) before it closes.
If the key has the Support form ability, Support settings switch to the new key by themselves. A key with only Messenger does not: pick the new key on the Messenger tab of Support settings and save.
Revoke a key
Section titled “Revoke a key”Revoke stops the key at once. Tracking and the widgets stop working on every site that uses it.