---
title: API Keys
description: Configure public API keys for Next.js and React support widgets.
---

## Get your public key

Open your dashboard at **Settings → Developers** and create or copy a **Public key**.

## Configure environment variables

<Tabs defaultValue="nextjs" className="mt-6">
  <TabsList>
    <TabsTrigger value="nextjs">Next.js</TabsTrigger>
    <TabsTrigger value="vite">Vite</TabsTrigger>
    <TabsTrigger value="other">Other</TabsTrigger>
  </TabsList>
  <TabsContent value="vite">

```bash title=".env"
VITE_COSSISTANT_API_KEY=pk_live_xxxxxxxxxxxx
```

  </TabsContent>
  <TabsContent value="nextjs">

```bash title=".env.local"
NEXT_PUBLIC_COSSISTANT_API_KEY=pk_live_xxxxxxxxxxxx
```

  </TabsContent>
  <TabsContent value="other">

```bash title=".env"
COSSISTANT_API_KEY=pk_live_xxxxxxxxxxxx
```

  </TabsContent>
</Tabs>

<Alert variant="info" className="mt-6">
  <Icon name="help" className="size-4" />
  <AlertTitle>Auto-detection</AlertTitle>
  <AlertDescription>
    The SDK automatically detects your framework and checks
    `VITE_COSSISTANT_API_KEY` (Vite), `NEXT_PUBLIC_COSSISTANT_API_KEY`
    (Next.js), or `COSSISTANT_API_KEY` (other). You can also pass the key
    explicitly through `publicKey`.
  </AlertDescription>
</Alert>

## Public vs private keys

| Type        | Prefix                   | Purpose              | Safe in browser |
| ----------- | ------------------------ | -------------------- | --------------- |
| **Public**  | `pk_live_*`, `pk_test_*` | Widget integration   | Yes             |
| **Private** | `sk_live_*`, `sk_test_*` | Server-to-server API | No              |

Only use **public** keys in frontend widget code.

## Allowed domains

Public keys work only on whitelisted domains.

- Production keys (`pk_live_*`) require explicit allowlisting.
- Test keys (`pk_test_*`) work on localhost.

Use full origins, for example:

- `https://example.com`
- `https://app.example.com`
- `https://staging.example.com`

## Troubleshooting

### Configuration error in the widget

Check:

- env variable name is correct for your framework
- key is still active
- app was restarted after env changes

### Domain not allowed

Check:

- domain is listed in **Settings → Developers → Allowed domains**
- protocol matches (`https://`)
