Reference
Environments and API keys
Keep test traffic out of production data, and manage SDK and secret keys safely.
Environments#
Every project has three environments: Development (dev), Staging (staging) and Production (prod). Experiments belong to the project and are shared by all three. Assignments and events are tagged with the environment of the key that sent them.
This lets you point your local and staging sites at the same experiment as production without polluting real results: use a dev key locally, a staging key on staging and a prod key on the live site. Filter results with ?environment=prod on the results API.
Note
A visitor assigned in one environment keeps that variation in the others, because assignment is per experiment and visitor ID.
Key types#
| SDK key | Secret key | |
|---|---|---|
| Format | cro_pk_<env>_ plus 32 characters | cro_sk_<env>_ plus 32 characters |
| Where | Browsers, page source | Servers only |
| Can call | /api/assign and /api/track | Experiment and results endpoints for its project |
| Safe to expose? | Yes | No |
Creating and revoking keys#
Open API keys in the sidebar. Each environment has New SDK key and New secret key buttons. The full key is shown once, right after you create it. It is not stored in readable form, so nobody can see it again later. The list shows each key's prefix, creation date, last use and status.
Choose Revoke to disable a key. Anything using it gets 401 on the next request. Revoking cannot be undone.
Rotating a key#
- Create a new key in the same environment.
- Deploy it to your site or server.
- Check that Last used updates on the new key.
- Revoke the old key.
If a secret key leaks
Revoke it straight away, create a new one, and review recent experiment changes.