PublishableKeyPayload
Defined in: publishableKey.ts:27
The publishable key:
st_pk_<env>_<base64url(JSON { organizationId, apiBase, sig })>.
The publishable key is a signed credential minted in the dashboard. Every
stream request must carry it (st-key query param, see protocol.ts). Test
keys (st_pk_test_) work on their own for development; live keys
(st_pk_live_) only work from an origin registered to your organization.
Treat it like any client-side key: it is visible in page source, so
protection comes from the origin registry and rate limits; rotate it from
the dashboard if it leaks.
The SDK decodes the payload locally (zero network) to fill organizationId
and apiBase, and ignores every other field — sig included. It holds no
secret, so it cannot verify or produce a signature; only the server does.
organizationId and apiBase remain explicit props for self-hosted bases
— when both are given, the explicit props win for addressing, and the key
is still sent as the credential.
Because the client cannot verify the signature, an apiBase that arrives VIA a key is still an unproven host client-side. Content fetches may follow it, but the mint token — a spend credential — may not: the mint POST fires only for an explicit, first-party (*.sparkletree.io, *.qrtree.ai), or loopback apiBase (security review S-2; see isFirstPartyApiBase/maybeMint).
Properties
Section titled “Properties”apiBase
Section titled “apiBase”apiBase:
string
Defined in: publishableKey.ts:29
organizationId
Section titled “organizationId”organizationId:
string
Defined in: publishableKey.ts:28