API Keys

API keys authenticate your widget and server-side API calls. Each key belongs to a single project.

Creating a key

1. Open your project in the dashboard
2. Go to Settings → API Keys
3. Click + New Key
4. Give it a name (e.g. Production Widget, Backend)
5. Copy the key immediately — it will only be shown once

Key types

Lumifeed currently supports one key type: publishable widget keys. These are safe to embed in client-side code because they can only submit feedback, not read it.

For server-side operations (listing feedback, triggering AI, etc.) use your session cookie via the dashboard OAuth session, or contact support for server-to-server access tokens.

Rotating keys

If a key is compromised:

1. Go to Settings → API Keys
2. Click Revoke next to the old key
3. Create a new key
4. Update your widget configuration

Security

• Never commit API keys to source control
• Use environment variables: NEXT_PUBLIC_LUMIFEED_KEY for client-side, LUMIFEED_KEY for server-side
• Keys are rate-limited: 10 submissions per minute per key (configurable on paid plans)