Keys identify your organization to Fingerly and decide what a request may do. Every key belongs to one environment and one region, and both are written into the key itself.
Environments
| Environment | Public key prefix | Billed | Use it for |
|---|---|---|---|
| Development | fly_pk_us_development_ | No | Local development and CI. |
| Staging | fly_pk_us_staging_ | No | Pre-release testing with realistic traffic. |
| Production | fly_pk_us_production_ | Yes | Real visitors. |
All three run exactly the same detection. What differs is billing, and everywhere results are read:
- A secret key reads only events from its own environment.
- Dashboards and the Events view filter by environment.
- Webhook endpoints listen to Live (production) or Test (staging and development) traffic.
- Usage counts non-production requests separately, as not billed.
Kinds of key
| Kind | Where it lives | What it does |
|---|---|---|
Public, fly_pk_ | Web pages and apps | Identifies visitors. Accepted only from its allowed origins in browsers. |
Secret, fly_sk_ | Your servers | Reads events. Refused from browsers. |
Proxy, fly_px_ | Your proxy | Forwards identify requests with visitor details. See proxy integrations. |
Management, fly_mk_ | Your automation | Manages keys, webhook endpoints and risk weights through the management API. Belongs to no environment. Refused from browsers. |
Create a key
In the dashboard, open Integration > SDK keys and create a key. Choose its kind and environment, name it, and for a public key list its allowed origins. You can also set an expiry date. Proxy keys are issued separately, in Integration > Proxy keys.
Owners, admins and developers can create and revoke keys. To create keys from code, for example with each new staging environment, use the management API.
Management keys
Management keys let automation manage your integration without a person signed in. Owners and admins issue them in Integration > Management keys, each acting with the admin or developer role. A management key is shown once, is refused from browsers, and cannot issue other management keys. See the management API.
Allowed origins
A public key is accepted from a browser only when the page's origin exactly matches one of the key's allowed origins.
https://shop.example.com
https://www.example.com
http://localhost:3000
- An origin is a scheme, a host and an optional port, with no path and no trailing slash.
- Matching is exact:
https://example.comdoes not allowhttps://www.example.com, and there are no wildcards. - A public key with no allowed origins refuses every browser request.
- Native apps identify their platform instead of an origin, so mobile SDKs do not need one.
You can change a public key's allowed origins at any time from its row in SDK keys. The change applies within a minute.
Revoke a key
Revoking a key refuses it immediately and cannot be undone. Requests made with it afterwards fail with 401, and each sends an identification.refused webhook with the reason revoked_key, so you can find any deployment still using it.
Rotating a key
- Create the new key in the same environment.
- Deploy it everywhere the old one is used.
- Watch the old key's usage fall to zero in SDK keys.
- Revoke the old key.
Regions
The region in a key, such as us, decides which regional API accepts it. A key is refused by any other region's API. See regions and data residency.