Client apps
Publishable key in the widget, secret key on the server.
{ "kind": "publishable", "preset": "generate_only", "allowedOrigins": ["https://shop.example.com"] }Storefront / chat widget: publishable + generate_only or resource_writer.
Anything that lists the catalog for mutating work, edits cells, creates connectors, or flushes exports: secret key on a backend. Never embed pim_sk_ in a browser or mobile binary.