Auth
Secret vs publishable org keys, presets, and policy JSON.
{
"name": "storefront-widget",
"kind": "publishable",
"preset": "generate_only",
"allowedOrigins": ["https://shop.example.com"],
"workspaceIds": ["<workspace-uuid>"]
}Mint from Organisation settings (org admin) or POST /organisations/:organisationId/api-keys. Raw secret is shown once.
Kinds
| Kind | Prefix | Where |
|---|---|---|
| Secret | pim_sk_ | Next BFF, cron, agent runtime. Never browsers or mobile binaries. |
| Publishable | pim_pk_ | Browser/mobile. Requires allowedOrigins. CORS Origin check. No keys, invites, connector credentials, exports.flush. |
Do not send Better Auth personal /api-keys to /v1.
MCP (Claude/Cursor) uses OAuth, not these keys. Connect: /docs/mcp.
Presets
org_admin · workspace_admin · workspace_member · workspace_viewer · resource_writer · generate_only
Policy is the ACL. The key is not the creating user.
Local: AUTH_DISABLED cannot mint keys. Set PIM_LOCAL_API_KEY to a pim_sk_test_... value to call /v1.