API keys

Public and secret keys: what each may do, rotation, storage.

Two kinds of keys

Key	Prefix	Belongs in	Authority
Public	`basket_public_…`	Browsers, mobile apps	Client operations. Basket rules decide record access; Auth client flows (sign-up, sign-in) work with it. It can never change schema, mint user tokens by fiat, or administer users.
Secret	`basket_secret_…`	Your backend only	Everything the public key can, plus schema changes, unrestricted reads/writes, Auth user administration, and minting custom user tokens.

A secret key in frontend code is an administrator credential in every visitor's browser. If one leaks, revoke it in the console — revocation is immediate.

Creating and revoking

API keys in your project creates either kind. The full key appears once, at creation — Flares stores a hash, so there is no reveal button anywhere, for anyone. Rotation is: create the replacement, deploy it, revoke the old one.

API keys: kind, prefix, last four — and a one-time reveal at creation.

Sending a key

Authorization: Bearer basket_secret_…        # preferred
X-Basket-Key: basket_public_…                # alternative header

The key names its project; the URL names one too. They must agree — using project A's key against project B's URL is refused regardless of your permissions in either.