Keys
Every install uses three values. They come from the group's widget settings. The install snippet there already contains the group id and a public key.
| Key | Prefix | Where it lives |
|---|---|---|
| Group id | grp_ | The widget. It names this brand. |
| Public key | pk_ | The browser. It authorizes the widget. |
| Identify secret | isk_ | Your server only. It signs identify. |
Group id
group in initialize is the group id, grp_…. One group is one brand. A second brand is a second group and a second id.
Public key
apiKey is a public key, pk_…. The widget sends it as a bearer token. It is safe to ship in a page.
Before you go live, restrict the key to your website under Allowed origins. An origin is an absolute http or https URL. With no origins set, the key works from any site. You can create more than one key and name each by where it is deployed. Deleting a key stops every widget that uses it.
Identify secret
The identify secret, isk_…, is optional. Create it under Signed-in customers when you want Cusu to reject unsigned identify calls. The app shows the secret once. Save it then. Rotate it if it leaks.