Keys you create in the dashboard start with
pl_live_. The key is meant to be public: it sits in your page’s HTML. Allowed origins, Turnstile and rate limits are what protect it.What a key can do
A key only authenticates the widget. Keys have no scopes. Only Admins can create, rotate and revoke keys.Create a key
You create keys in the dashboard, in the API keys and embed card on the Settings page. Enter a key name, for example “Production site”, and select Create key. The default name is “Widget key”. The dashboard shows the full key one time. Copy it and store it in a safe place. If you lose a key, rotate it. Your workspace can have up to 20 active keys.Rotate a key
Rotation makes a new key with the same name. The old key keeps working for 10 more minutes, so you have time to deploy the new key. To stop the old key at once, select the checkbox “Revoke the current key immediately (use this if it leaked)”.Revoke a key
A revoked key cannot be restored. The key can take about 60 seconds to stop working everywhere.If a key leaks
1
Rotate the key and revoke the old one
Rotate the key and select the checkbox “Revoke the current key immediately (use this if it leaked)”. The old key stops working in about 60 seconds. The widget stops answering until the new key is deployed.
2
Deploy the new key
Put the new key in your site.
3
Check your allowed origins
Open Settings and check the Allowed origins list. Only your own sites must be on it. An empty list allows any site.
4
Watch Conversations
Open Conversations and look for questions that you do not expect. Set the Source filter to Widget to see widget traffic.
Allowed origins, Turnstile and rate limits
Learn how the three protection layers work together.