Publishable keys

A publishable key (end_pk_live_...) names your organization and nothing else. It is safe to embed in page source, ship in a bundle, or commit to a public repository. It exists so a browser can call the API without holding anything sensitive. One endpoint accepts it - POST /v1/taps, which exchanges a tap for a session token - and it authorizes nothing on its own: the authority in that exchange is the one-time e value from the tap, which cannot be forged and works exactly once. That endpoint takes an API key too. Same path, same request, same response - the credential you send is what changes, so a page with no backend behind it and a server-side integration use the same call.

Retrieve your key

List your organization’s keys. If you have none yet, one is created on the first call, so you always get something usable.

await endstate.publishableKeys.list();

curl https://api2.endstate.io/v1/publishable-keys \
  -H "Authorization: Bearer end_sk_..."

Response

{
  "publishable_keys": [
    {
      "id": "3f9a1c22-8b7d-4e51-9f10-2c3d4e5f6a7b",
      "key": "end_pk_live_0123456789abcdef0123456789abcdef",
      "mode": "live",
      "name": "Default",
      "created_at": "2026-05-14T10:30:00.000Z"
    }
  ],
  "pagination": {
    "limit": 50,
    "has_more": false,
    "next_cursor": null
  }
}

Retrieving the key requires your secret key, so make this call from your server or your terminal - never from the page that will use it. Read key once at build or deploy time and inline the value; there is no reason for a browser to fetch it at runtime.

string

The credential itself. Send it as Authorization: Bearer end_pk_live_....

string

live or sandbox. Only live keys are issued today.

string

Display name, to tell keys apart when you have more than one.

What it can and cannot do

	Publishable key	Secret API key
Safe in a browser	Yes	Never
Reads your catalog	No	Yes
Writes anything	No	Yes
Accepted as a credential	`POST /v1/taps` only	Most `/v1/*` endpoints

Losing control of a publishable key does not expose your data. Someone else holding it can only do what any visitor to your page could already do: exchange a genuine tap they physically performed for a session token scoped to that one chip.

This is not a lesser API key - it is a different kind of thing. Do not substitute one for the other. A secret key in browser code is a full compromise of your organization’s data; see Credentials.

Before it works in a browser

A publishable key is only half of browser setup. Browser requests carrying one are matched against your organization’s origin allow-list, so add the origins your pages are served from before going live - see CORS origins. A request with no Origin header is not origin-checked: the allow-list governs where the key may be embedded, not who may call the API. The one-time e value from the tap remains the authority.

Get started

Settings

Core concepts

API conventions

Updates

Retrieve your key

What it can and cannot do

Before it works in a browser

Next steps

CORS origins

Host your own verify page

​Retrieve your key

​What it can and cannot do

​Before it works in a browser

​Next steps

CORS origins

Host your own verify page

Retrieve your key

What it can and cannot do

Before it works in a browser

Next steps