Docs
Swagger

Dashboard

SDK keys

Browser credentials for the macrocontent SDK — PUBLIC and DEVELOPMENT keys, origin allowlists, and safe rotation.

API keybrowser

Where in the app
Open a website → Settings → SDK. For server automation use API tokens (mt_…) instead.

Key types

NameTypeDescription
PUBLICpk_…Browser SDK on real hostnames. Configure Allowed Origins. Scopes: live content read.
DEVELOPMENTdk_…Staging / development browser SDK. Toggle on/off in Settings; do not use for production traffic.
SECRETsk_…Legacy server key for Content API. Prefer mt_ API tokens for new automation.
When to use PUBLIC (pk_)

Production (and staging) browser traffic. Put publicKey: 'pk_…' in macro.config.js together with your website ID. Restrict Allowed Origins to the hostnames that may load the SDK.

When to use DEVELOPMENT (dk_)

Staging or development environments. Toggle the Development Key on when you want a separate frontend credential you can disable without touching production. Do not ship dk_ keys to production visitors.

What about SECRET (sk_)?

Legacy secret keys still authenticate some Content API flows (for example prerender or CI). New websites no longer auto-create them. Prefer API tokens with least privilege for any new server automation.

Origins whitelist

The PUBLIC key only accepts browser requests from listed origins. Add exact origins such as https://www.example.com. When you change the site’s primary domain, the dashboard can offer to update the public key allowlist — you can always edit origins later under SDK.

Do

  • List every production (and staging) origin that loads the SDK.
  • Use the Development key for staging instead of opening production origins too wide.
  • Regenerate keys after a leak; the previous key keeps a short grace period.

Don’t

  • Don’t commit sk_ / mt_ secrets into public front-end config.
  • Don’t use a DEVELOPMENT key for production traffic.
  • Don’t leave the PUBLIC allowlist empty if you expect origin checks to protect the site.

Rotation lifecycle

  1. Regenerate in Settings → SDK

    Choose Regenerate on the PUBLIC or DEVELOPMENT key. A new raw key is shown once (when reveal is allowed). Copy it into your config immediately.

  2. Grace period

    The previous key remains valid for a short grace window (dashboard default: 48 hours) so you can roll out config without downtime.

  3. Deploy the new key

    Update macro.config.js (or your env injection) everywhere the SDK boots. After the grace period, the old key stops working.

Wire the SDK

macro.config.js
export const macroConfig = {
  apiBaseUrl: 'https://api.macrocontent.dev',
  websiteId: 'your-website-uuid',
  publicKey: 'pk_...',
}

Full install steps: Developer quickstart · Content API auth: Content API

GET/management/sdk-keysmt_

List SDK keys for the website (Management API; requires sdk_keys:read).