Tokens and credentials
Which credential do I use?
Browser code uses a publishable key, trusted servers use an environment secret key, and application requests carry short-lived session tokens.
What the React SDK can access
@authie/react reads safe client, session, and user resources from Authie's Frontend API. It can request a short-lived session token for your application API, but never receives the environment secret key or Authie's long-lived session credential.
The complete map
| Credential | Represents | Where it belongs | Used for |
|---|---|---|---|
| Developer session | You, signed into the Authie console | Your browser | Manual configuration |
| Publishable key | One application environment | Browser and server configuration | Locating and scoping the Frontend API |
| Secret key | One application environment | Backend secret storage only | Calling the Backend API |
| Session token | One user session in one application environment | Short-lived request credential | Authenticating application requests |
| Authie session credential | The long-lived browser session | Authie-controlled secure storage | Rotating session tokens and ending sessions |
Provisioning credentials
authie init uses a short-lived, browser-approved enrollment ceremony and returns the environment secret once. Do not copy workspace-wide management credentials into an application. Production secrets begin with authie_sk_live_; development secrets begin with authie_sk_test_.