What's the difference between publishable and secret keys?

Atlas uses two kinds of keys, and the split is enforced by construction, not by convention:

• Publishable key (pk_live_…) — used by frontend and mobile SDKs. Safe to embed in a browser bundle because it is scoped to exactly the public operations a logged-out visitor could already perform. If it leaks, nothing privileged leaks with it.

• Secret key (sk_live_…) — used by backend SDKs only. Stays on your server. Grants privileged, server-side operations (managing users, verifying sessions, administering organizations).

Both keys are scoped to a single instance, so a key can never touch another instance's data. Client SDKs are simply incapable of privileged operations. Manage and rotate keys in the dashboard's API Keys view. See the keys guide.