# Keys for your developer

> Everything your developer needs is on your platform’s Connection tab. What to send, how to send it safely, and what to do if a key leaks.

Source: https://dashboard.adquest.batriders.ir/docs/dashboard/keys · Audience: Publishers · Section: Start here

## Find the Connection tab

Open your platform and choose **Connection**. The card at the top lists what is left: **Create an API key**, **Generate a secret key**, **Add AdQuest to your app** and **First completion**, each with an **Open** link. Below it are four tabs: **Keys**, **Reward notices**, **Where it runs** and **Embed code**.

> **Keys work before approval.** You can create keys as soon as the platform exists. Only the Embed URL waits until the platform is approved.

## What you will find

| Item | Where | Secret? | Who needs it |
| --- | --- | --- | --- |
| API key (aqk_) | **Keys**. Choose **Create Key**; the key is shown once. | No. It is safe inside your app. | Your developer, for the app or site. |
| Secret Key (aqs_) | **Keys**. Choose **Generate secret key**; it is shown once. | Yes. Server only. | Your developer’s server. |
| Event signing secret | **Keys**. Choose **Generate**. | Yes. Server only. | Your developer, if your server proves verified events or multi-step steps. |
| Embed URL | **Embed code**. Appears after approval. | No. | Your developer, for an iframe or WebView. |
| Webhook signing secret (whsec_) | **Reward notices**. Shown when you add a webhook. | Yes. | Your developer’s server, to check each notice. |

> **Warning: Keep the Secret Key private.** New keys and secrets are shown once. Copy them straight into your team’s password manager, and never post the Secret Key in chat, email or a ticket. Until it is saved on your server, people cannot open AdQuest.

## Send this to your developer

- The API key (aqk_).
- The Secret Key (aqs_), through a password manager. Never in chat, a ticket or an email.
- The Embed URL, if they use an iframe or WebView.
- The Event signing secret, if your server proves verified events or multi-step steps.
- The webhook signing secret, if they set up reward notices.
- A link to the developer documentation: /docs.

- [Developer quickstart](https://dashboard.adquest.batriders.ir/docs/quickstart): What your developer does with these.

## Reward notices

1. Ask your developer for the address that should receive notices.
2. On **Reward notices**, choose **Add webhook** and paste the address under **Webhook URL**.
3. Under **Notices to send**, pick what they need: **A player finishes a quest**, **Someone wins a prize**, or **A reward needs fulfilling by you** (this one needs https).
4. Tick **Send test notices only** while you test, then choose **Save webhook**.
5. Copy the **Signing secret** that appears and send it to your developer through a password manager.

**Recent notices** lists every delivery. After your developer fixes their server, **Send again** delivers a notice once more.

## If a key is lost or leaked

| Key | What to do | The old one |
| --- | --- | --- |
| API key | Choose **Rotate** on its row, or **Revoke** to remove it for good. | Stops working at once. Update the app straight away. |
| Secret Key | Choose **Rotate secret key**. | Keeps working for 24 hours, so your developer can switch the server first. |
| Event signing secret | Choose **Rotate**. | Keeps working for 24 hours. |
| Webhook signing secret | Choose **New signing secret** on the webhook. | Stops working at once. |

## Where AdQuest may appear (optional)

1. On the **Connection** tab, open **Where it runs**.
2. Under **Website addresses**, add each address your app runs on, one per line, with https:// and the port if there is one, such as https://app.example.com. Leave out page paths.
3. For a mobile app, fill in **App package name** instead, such as com.example.app.
4. Choose **Save Restrictions**.

> **Ask your developer for the addresses.** They know every address the app runs on, including test ones such as http://localhost:3000. Once you add an address, AdQuest is refused everywhere else.

## Next steps

- [Brand it in Theme Studio](https://dashboard.adquest.batriders.ir/docs/dashboard/theme-studio): Make AdQuest look like your app.