Environments and keys

Your tenant has two environments: test and live. They never share data. A test key cannot read a live object, and a live key cannot read a test object.

	Test	Live
Key prefix	vk_test_, rk_test_, vpk_test_	vk_live_, rk_live_, vpk_live_
Streams	A simulated network, no video and no bill	A real video network
Payments and messages	Not available with test keys yet	Real checkout and real messages
Objects return	"livemode": false	"livemode": true

Test keys are available from the first minute, with no approval. See test mode for what works with test keys today.

Key types

Type	Prefix	Where to use it
Secret	vk_live_, vk_test_	Your server. Full access to the products you have enabled.
Restricted	rk_live_, rk_test_	Your server, with only the scopes you pick, for example streams:write events:read.
Publishable	vpk_live_, vpk_test_	Browsers and apps. Starts a checkout or a playback session and sends telemetry, nothing else.

Secret and restricted keys

Send them as a bearer token.

Authorization: Bearer vk_test_...

Prefer restricted keys for each service you run, so a leaked key can do less. Scopes are listed in keys and scopes.

Publishable keys

Send them in a header, or in the key query parameter on public embeds.

Vabu-Publishable-Key: vpk_test_...

A publishable key is safe to ship in client code. It only works on endpoints marked as publishable in the API reference.

Handle keys safely

• The full key is shown once, when you create it. Vabu OS stores only a hash and an 8-character prefix, so it cannot show the key again.
• Store keys in your secret manager or environment variables. Do not commit them.
• Roll a key to replace it. The old key keeps working until the expiry you choose, immediately or up to 7 days, so you can deploy the new one first.
• If a key leaks, revoke it from the console or the API. Revoking takes effect right away, and your tenant owners get an email.
• A key can have an expiry date and an IP allowlist.