> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usefrictionless.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys and secrets

> Which secret does what, where to create them, and how to rotate one without downtime.

Your **Workspace ID** is public. It goes in the website snippet, and anyone on your team can copy it from **Integrations → Website chat**.

Everything else is a secret. A workspace owner creates them in **Settings → Developers**. Each has one job, so rotating one never breaks the others:

| Secret | Looks like | Used for |
| - | - | - |
| API key | `fk_live_…` | Calls to the [REST API](/api-reference/introduction) |
| Identity secret | `fk_id_…` | Signing `userHash` for [`identify()`](/context-api/website) |
| Webhook secret | `whsec_…` | Checking the [Action](/context-api/actions) requests we send you |

Until you create an identity or webhook secret, your API key does that job, as it did before they were split.

<Warning>
  Secrets are shown once. Store each as an environment variable on your server, and never put one in a web page or a mobile app.
</Warning>

## Sending the API key

Put it in the `Authorization` header:

```bash theme={null}
curl https://api.usefrictionless.com/api/v1/contacts/user_42 \
  -H "Authorization: Bearer $FRICTIONLESS_SECRET_KEY"
```

The API only accepts calls from servers. Browsers are blocked, so a key can't leak through a web page.

## Rotating a secret

* **No downtime:** choose **Keep old for 24 hours**, deploy the new secret, and the old one stops by itself.
* **It leaked:** choose **Stop the old one now**.
* Rotating the **identity secret** changes every `userHash`, so deploy the new one before the old one stops.

## Your users' data

Send only what agents need to help. You're responsible for having a lawful basis to share your users' data with Frictionless. Our [privacy policy](https://usefrictionless.com/privacy) explains how we handle it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.