# Keys and environments

> The four values you get from the publisher, where each one goes in your app, and how to keep them safe.

Source: https://dashboard.adquest.batriders.ir/docs/environments · Audience: Developers · Section: Get started

## What to ask the publisher for

The publisher registers the platform and creates the keys in the dashboard. Ask them for:

| Value | Format | Where it goes |
| --- | --- | --- |
| Public API key | aqk_… | Browser or app code. It is public. |
| Secret Key | aqs_… | Your server only. |
| Embed URL | https://sdk.adquest.batriders.ir/{publicId} | The iframe or WebView. |
| Webhook signing secret | Shown once when you register an endpoint | Your webhook receiver only. |

> **Before anything works.** The platform must be approved and live, with its quests switched on. Ask the publisher to confirm, and to add your site’s address under Where AdQuest may appear if they limit it.

> **Warning: Never put the Secret Key in browser or app code.** Anyone who has it can create participant sessions for any user. Keep it on your server, load it from the environment and never prefix it with NEXT_PUBLIC_.

- [Publisher guide: keys for your developer](https://dashboard.adquest.batriders.ir/docs/dashboard/keys): Send this page to the publisher.

## Configure your app

1. Store the public API key and the API URL where your frontend can read them.
2. Store the Secret Key and the API URL on your server only. Never prefix the Secret Key with NEXT_PUBLIC_.
3. Use the API URL of the environment that issued the keys, including /api/v1. The SDK adds /platform paths. Do not put /platform at the end of baseUrl.

**Example configuration (placeholders only)**

```env
# Public, safe to use in the browser
NEXT_PUBLIC_ADQUEST_PLATFORM_API_KEY=YOUR_PUBLIC_API_KEY
NEXT_PUBLIC_ADQUEST_API_URL=https://api.adquest.batriders.ir/api/v1

# Server only — never prefix with NEXT_PUBLIC_
ADQUEST_PLATFORM_SECRET=YOUR_SECRET_KEY
ADQUEST_API_URL=https://api.adquest.batriders.ir/api/v1
```

## Environments

| Environment | API URL | Notes |
| --- | --- | --- |
| Production | https://api.adquest.batriders.ir/api/v1 | Use the keys of your production platform. |
| Local API | http://localhost:8000/api/v1 | The default of the bundled OpenAPI file. Use keys created in that same environment. |

Keys belong to the environment that issued them, so a key from one environment is refused in another. Webhooks can be created in Test (sandbox) or Live mode.

## Allowed origins

The publisher can limit where AdQuest runs with the platform’s Where AdQuest may appear setting. When it is set, each origin needs its scheme and port, such as https://app.example.com or http://localhost:3000, with no page path, and a mobile app needs its package name. For a hosted embed, requests also come from https://sdk.adquest.batriders.ir. The public key must belong to the same platform as the participant token and the Embed URL.

- [ORIGIN_FORBIDDEN and PACKAGE_FORBIDDEN](https://dashboard.adquest.batriders.ir/docs/errors): What to check when requests are refused.

## Rotate credentials

- Rotating an API key replaces it immediately. Update every deployment that uses it. A disabled key stops working, and revoking is permanent.
- Rotating the Secret Key keeps the previous one valid for 24 hours. Update your backend in that window.
- The webhook signing secret and the server-event signing secret are separate from the Secret Key. Never swap one for another or for the public key.

## Next steps

- [Quickstart](https://dashboard.adquest.batriders.ir/docs/quickstart): Show your first quest.
- [Authentication](https://dashboard.adquest.batriders.ir/docs/authentication): Which header carries which credential.