https://shipreadyai.dev/glossary/publishable-key

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Publishable key

The newer name for a public client key. Same rule: public by design, not a permission.

A publishable key is a public identifier a service gives you for browser use. Stripe has one, Supabase has one, most platforms have one. It is designed to sit in client code where anyone can read it.

The danger is the pair it travels with. Every service that issues a publishable key also issues a secret one, and the two look similar enough that an agent copying configuration will sometimes take the wrong one. A publishable key in the bundle is normal. A secret key in the bundle is an emergency.

A check reads your client JavaScript and distinguishes the two by prefix and shape. Publishable keys are reported as nothing at all. Secret keys are reported as finding O4, with the evidence line and the date so you can act on it immediately.