Keys and environments
The four values you get from the publisher, where each one goes in your app, and how to keep them safe.
On this page
What to ask the publisher for
The publisher registers the platform and creates the keys in the dashboard. Ask them for:
| Value | Format | Where it goes |
|---|---|---|
| Public API key | aqk_… | Browser or app code. It is public. |
| Secret Key | aqs_… | Your server only. |
| Embed URL | https://sdk.adquest.batriders.ir/{publicId} | The iframe or WebView. |
| Webhook signing secret | Shown once when you register an endpoint | Your webhook receiver only. |
Configure your app
Store the public API key and the API URL where your frontend can read them.
Store the Secret Key and the API URL on your server only. Never prefix the Secret Key with NEXT_PUBLIC_.
Use the API URL of the environment that issued the keys, including /api/v1. The SDK adds /platform paths. Do not put /platform at the end of baseUrl.
# Public, safe to use in the browser
NEXT_PUBLIC_ADQUEST_PLATFORM_API_KEY=YOUR_PUBLIC_API_KEY
NEXT_PUBLIC_ADQUEST_API_URL=https://api.adquest.batriders.ir/api/v1
# Server only — never prefix with NEXT_PUBLIC_
ADQUEST_PLATFORM_SECRET=YOUR_SECRET_KEY
ADQUEST_API_URL=https://api.adquest.batriders.ir/api/v1Environments
| Environment | API URL | Notes |
|---|---|---|
| Production | https://api.adquest.batriders.ir/api/v1 | Use the keys of your production platform. |
| Local API | http://localhost:8000/api/v1 | The default of the bundled OpenAPI file. Use keys created in that same environment. |
Keys belong to the environment that issued them, so a key from one environment is refused in another. Webhooks can be created in Test (sandbox) or Live mode.
Allowed origins
The publisher can limit where AdQuest runs with the platform’s Where AdQuest may appear setting. When it is set, each origin needs its scheme and port, such as https://app.example.com or http://localhost:3000, with no page path, and a mobile app needs its package name. For a hosted embed, requests also come from https://sdk.adquest.batriders.ir. The public key must belong to the same platform as the participant token and the Embed URL.
Rotate credentials
- Rotating an API key replaces it immediately. Update every deployment that uses it. A disabled key stops working, and revoking is permanent.
- Rotating the Secret Key keeps the previous one valid for 24 hours. Update your backend in that window.
- The webhook signing secret and the server-event signing secret are separate from the Secret Key. Never swap one for another or for the public key.