# API keys and allowed sites

> Public keys, their abilities, the sites they work on, rolling and revoking.

Your website identifies itself to CustomerCatalyst with a **public key**. Manage keys under **Settings › API keys** (organization admins).

## Public keys

A public key starts with `pk_`. It goes into your website's code, so anyone can see it. That is fine: it can only send usage events and open the widgets, and only on the sites you allow. Keys never expire on their own; they work until you roll or revoke them.

Each key shows its name, the full key (you can copy it again any time), its abilities, its sites, when it was last used and its status: **Active**, or *Closes …* after a roll.

## Abilities

Pick at least one when you create a key:

| Ability | Lets the key |
|---|---|
| **Usage tracking** | Send usage events from your product. |
| **Messenger** | Open the Messenger widget. |
| **Support form** | Open the support form. |

One key may have all three. Messenger and the form always use the same key, chosen on the Messenger or Form tab of Support settings.

## Allowed sites

Every key needs at least one site. The key works only on pages from these sites:

- **An exact site**: `example.com`, `shop.example.com`, or `localhost:3000` for testing. It must match exactly: `example.com` does not allow `www.example.com` or `example.com:8080`.
- **A wildcard**: `*.example.com` allows every subdomain (`www.example.com`, `help.example.com`), on any port, but **not** `example.com` itself. Add both if you need both.

Paste a full address if you like: `https://example.com/contact` is saved as `example.com`. Wildcards on shared hosting addresses (like `*.vercel.app` or `*.github.io`) are refused, because they would allow other people's sites too.

**A key with no sites works nowhere.** If a page isn't on the list, Messenger and the form simply don't show there.

### Seen on sites not on the list

When a key is used on a site that isn't on its list, the site appears under *"Seen on sites not on the list:"* with an **Add** button. Add it only if it is yours.

You can edit a key's name and sites any time with **Edit**. On the Support settings tabs, **Edit websites** and **Add websites** take you to the same place.

## Roll a key

**Roll** creates a new key with the same name, abilities and sites. Put the new key in your site's code, then let the old one close. Choose when the old key closes:

- **Now**
- **In 24 hours** (default)
- **In 7 days**

Until then, both keys work. Replace the old key in your site's code (`data-key`) before it closes.

If the key has the **Support form** ability, Support settings switch to the new key by themselves. A key with only **Messenger** does not: pick the new key on the Messenger tab of Support settings and save.

## Revoke a key

**Revoke** stops the key at once. Tracking and the widgets stop working on every site that uses it.