Concepts
Keys
The two-key model — what each key proves, and the one mistake with a security cost rather than a debugging cost.
Secret key vs publishable key
Clivly issues two keys and they are not interchangeable. Getting this wrong is the one mistake with a security cost rather than a debugging cost.
Server only
- Authenticates your app to Clivly
- Reads and writes your workspace
- Never in a client bundle
Browser safe
- Identifies your org to the chat widget
- Designed to be public
- Cannot read your workspace
trust boundary
What carries a key across the line
A NEXT_PUBLIC_ or VITE_ prefix inlines the value into JavaScript every visitor downloads. That is how a secret key leaks — not by being stolen, but by being published.
If you only remember one rule: `sk_` never gets a public prefix.
CLIVLY_SECRET_KEYauthenticates your server to Clivly. It must never reach the browser, a client bundle, or aVITE_/NEXT_PUBLIC_variable.CLIVLY_PUBLISHABLE_KEYidentifies your org to the chat widget. It is designed to be public and is safe in client code.CLIVLY_API_KEYis the former name of the secret key. It is still read as a fallback, but new setups should useCLIVLY_SECRET_KEY.- The dashboard Connect dialog emits both keys, already filled in — that is the shortest path to a working
.env.