Every website you protect has two keys: one that visitors can see and one that must never leave your server. The “Credentials” page of a key shows both in one place and says what each is for. The film below walks through that page with sample data, silent and with short captions. The text under it says the same in words, so you can follow along without playing the film.
The film in short
The film opens the “Credentials” page of a key, highlights the public key and the server key, clicks “Create server key” on a fresh account and shows what the page says in that case, and ends on the card “Which one do I need?”. It shows no key values and creates no server key. It has no sound and does not start by itself.
Step 1: open the Credentials page
Open your key in the dashboard and choose “Credentials” under “Protect” in the sidebar. The page opens with: “Both keys of this website in one place: the public key sits in the widget on your page, the server key stays on your server.”
Step 2: the public key
The card “Public key” carries the badge “In the browser” and says: “It sits in the widget on your page and is not a secret. Every visitor can see it.” It is used for “Widget and forms in the browser”, and the link “View the installation code” takes you to the snippet. The page also shows when the key was last seen.
Step 3: the server key
The card “Server key” carries the badge “Server only”: “The secret counterpart. Never put it into page code or the widget, only where your server talks to us. There is exactly one per website.” On a new website it says: “There is no server key for this website yet.” It is used for “Server-side verification and reputation lookups”.
Step 4: creating a server key
Press “Create server key”. The page tells you what is missing if the data processing agreement has not been accepted yet: “The server key can only be created once the data processing agreement (DPA) has been accepted. Accept it under “Billing & Invoices”, then try again.” Once a server key exists, its value is shown once and not again. Creating a new one makes the old one invalid at once, and rotating the API key does not carry the server key over, so after a rotation you replace both values in your integration.
Step 5: which one do I need?
The card “Which one do I need?” sums it up: for the “Page in the browser” (“Widget and forms”) you use the public key, and for “Your server” (“Verification and reputation lookups”) the server key. How the check in your server works is shown in add the server-side check.
What the film does not show
The film does not create a server key and shows no key value; the account in it is a test account with sample data. If you are setting up for the first time, start with setting up SilentShield step by step.