Your Workspace ID is public. It goes in the website snippet, and anyone on your team can copy it from Integrations → Website chat.
Everything else is a secret. A workspace owner creates them in Settings → Developers. Each has one job, so rotating one never breaks the others:
Until you create an identity or webhook secret, your API key does that job, as it did before they were split.
Secrets are shown once. Store each as an environment variable on your server, and never put one in a web page or a mobile app.
Sending the API key
Put it in the Authorization header:
The API only accepts calls from servers. Browsers are blocked, so a key can’t leak through a web page.
Rotating a secret
- No downtime: choose Keep old for 24 hours, deploy the new secret, and the old one stops by itself.
- It leaked: choose Stop the old one now.
- Rotating the identity secret changes every
userHash, so deploy the new one before the old one stops.
Your users’ data
Send only what agents need to help. You’re responsible for having a lawful basis to share your users’ data with Frictionless. Our privacy policy explains how we handle it. 
