---
title: "Monitoring Keys and Allowed Origins"
description: "Server keys and browser keys for Silly Development monitoring: what each can do, where to keep them, revoking them and allowing a website to send."
url: "https://sillydev.co.uk/docs/monitoring/keys"
updated: "2026-10-14"
---

Monitoring

# Keys

A key says which project data belongs to. Keys can only send data, never read it, so one that leaks cannot be used to see your dashboard.

[← Monitoring docs](https://sillydev.co.uk/docs/monitoring) · Updated 14 October 2026

**Browse the docs**

## Server keys

A server key starts with `sdevm_` and is for code you run: a bot, an API, a worker or a cron job. Keep it in an environment variable, not in your code or in Git. It can send metrics, errors, events, slow operations and heartbeats, and OpenTelemetry data.

The number after `sdevm_` is the ingest node the project lives on, and the SDKs work out the address from it: `sdevm_1_…` sends to `https://ingest1.sillydev.co.uk`. You never need to set the address yourself.

## Browser keys

A browser key starts with `sdevb_` and is meant to be in your website's page source, where anyone can read it. That is safe because it can only send browser data (errors, page views and web vitals) and only from the websites you list.

List each website under Allowed origins on the project's Settings tab, as scheme, host and port exactly: `https://example.com`, or `http://localhost:5173` while developing. A request from anywhere else is refused. A project can list up to 20 origins.

Never put a server key in a web page: it is not limited to your origins.

## Creating and revoking keys

Each project can have 5 keys of either kind. A key is shown once, when it is made, with the code to paste; after that the panel only shows its name and its first characters. Lost one? Make a new key and revoke the old one.

Revoking a key stops it working as soon as the change reaches the ingest, normally straight away. Data it already sent stays in the project. The key the panel makes for a linked server is not one of your keys and is removed when the server is unlinked.

Read next

- [Getting started From an empty project to errors, metrics and response times in a few minutes.](https://sillydev.co.uk/docs/monitoring)
- [Browser SDK Errors, page views and web vitals from your website.](https://sillydev.co.uk/docs/monitoring/browser)
- [Servers hosted here Linking servers, the key in the environment, and server history.](https://sillydev.co.uk/docs/monitoring/sillydev-servers)