Widget Publishable Keys

A widget publishable key tells Engine 64 which workspace and agent a browser request belongs to. The supplied widget sends it as X-Widget-Publishable-Key.

Publishable keys are designed to appear in browser source. They are identifiers, not secret server credentials. Domain checks and server-side tenant scoping remain part of every widget request.

What a key does

• It starts with wpk_live_.
• It is scoped to one agent and workspace.
• Engine 64 stores a SHA-256 hash rather than the full key.
• It can be revoked when you no longer want an embed to work.

Use and rotate keys

Open Publish for the target agent. If no active key exists, Engine 64 creates a default website embed key and includes it in the installation snippet.

When rotating a key:

1. Create the replacement and update every live embed.
2. Test chat on each allowed hostname.
3. Revoke the old key after the updated site is live.

Revoking first causes the old embed to return 401 until the website is republished.

Practical security

• Use clearly named, separate keys when staging and production need independent rotation.
• Keep the domain allowlist narrow and current.
• Never substitute a secret API token in the widget snippet.
• If a publishable key is copied to an unauthorised site, revoke it and review the allowed domains; the copied key alone should not grant that site access.