API Keys & Credentials
KEYRA issues project credentials with distinct client IDs and secret tokens. Use the right type in the right place.
On this page
Credential types
| Parameter | Type | Required | Description |
|---|---|---|---|
clientId | string | Required | Always prefixed cp_test_ (sandbox) or cp_prod_ (production). Identifies the key/project client. Publishable flows send this from the browser. |
clientSecret / token | string | Required | Always prefixed sk_test_ or sk_prod_. Treat as a secret. Used for server-side Partner 2FA (Authorization: Bearer clientId:clientSecret). |
projectId | UUID | Required | Your KEYRA project identifier. Required for Partner 2FA API bodies and SDK configuration. |
key type | publishable | secret | Required | Keys are typed in KEYRA. Publishable keys start hosted/browser flows. Secret keys are for server APIs. Hosted login rejects secret-type keys. |
Browser vs backend
Browser → publishable credentials only (
cp_* client ID)↓
Backend → secret credentials (
sk_*) + project configuration| Credential | Used where | Safe in browser? | Purpose |
|---|---|---|---|
Publishable clientId (cp_*) | Browser OAuth Verify / hosted login | Yes | Start authentication UI |
Secret token (sk_*) | Backend only | No | Partner 2FA and other secret API auth |
projectId | Backend (Partner 2FA) | Prefer backend | Scope identity operations to your project |
How credentials are sent
Partner 2FA (server):
Authorization: Bearer cp_test_…:sk_test_…Publishable browser header pattern:
x-keyra-client-id: cp_test_…Where to get them
Create and manage credentials in the Developer Portal under API keys for a sandbox or production project. Use sandbox (_test_) credentials while integrating.