Keys

Server keys

A server key starts with sdevm_ and is for code you run: a bot, an API, a worker or a cron job. Keep it in an environment variable, not in your code or in Git. It can send metrics, errors, events, slow operations and heartbeats, and OpenTelemetry data.

The number after sdevm_ is the ingest node the project lives on, and the SDKs work out the address from it: sdevm_1_… sends to https://ingest1.sillydev.co.uk. You never need to set the address yourself.

Browser keys

A browser key starts with sdevb_ and is meant to be in your website's page source, where anyone can read it. That is safe because it can only send browser data (errors, page views and web vitals) and only from the websites you list.

List each website under Allowed origins on the project's Settings tab, as scheme, host and port exactly: https://example.com, or http://localhost:5173 while developing. A request from anywhere else is refused. A project can list up to 20 origins.

Never put a server key in a web page: it is not limited to your origins.

Creating and revoking keys

Each project can have 5 keys of either kind. A key is shown once, when it is made, with the code to paste; after that the panel only shows its name and its first characters. Lost one? Make a new key and revoke the old one.

Revoking a key stops it working as soon as the change reaches the ingest, normally straight away. Data it already sent stays in the project. The key the panel makes for a linked server is not one of your keys and is removed when the server is unlinked.