SDK & Admin API Keys

Which Encatch key to use where. Publishable SDK keys for client apps, admin API keys for your backend.

Encatch uses two kinds of keys. Each is created per project under Settings → Security, and each works only with its own set of endpoints.

For the Web and Mobile SDKs running in your app. Safe to embed in client code.

For server-to-server calls from your backend. Secret, never expose them on a client.

Which key should I use?

	Publishable SDK key	Admin API key
Use it for	Showing feedback forms and collecting responses through the Web SDK and Mobile SDKs	Server-to-server calls to the Admin API, such as identifying users from your backend
Where it lives	In your website or mobile app	On your server only
Safe in client code	Yes, restricted by allowed domains and packages	No, it is a secret credential
Works with	SDK endpoints	Admin API routes only
Rate limits	SDK rate limits	Admin API rate limits
Manage it	Publishable SDK Keys	Admin API Keys

Using the wrong key type returns 403: a publishable key on an admin route, or an admin key on an SDK route.

Installing the SDK? Create a publishable key, then follow the Web SDK or Mobile SDK guide.
Calling Encatch from your backend? Create an admin key, then see the Admin API Reference.
Testing before launch? Read about the Sandbox Environment and its rate limits.