API Credentials

Open Apps, choose Manage, then open API credentials.

Publishable submission key

Each app has an active tt_pub_… key. It is safe to embed in websites, mobile apps, desktop apps, and extensions because it is restricted to feedback:create. It cannot read, edit, delete, moderate, export, or access account data.

Configure allowed websites one per line. Native clients do not send a browser Origin, so the publishable key remains protected by app, credential, IP, and plan limits.

Browser and native submissions can be enabled or disabled independently in the publishable key settings. These controls do not add read access: publishable keys always remain submission-only.

Replacing a publishable key revokes the old value. The TellTide widget obtains the replacement automatically; custom clients must be updated.

Private server keys

Private keys begin with tt_live_ or tt_test_. Use them only on trusted backends.

• Give each environment or service its own named key.
• Select only the scopes it needs.
• Choose an expiration or select No expiry. Expiring keys are recommended for unattended integrations.
• Copy the value when it is created; TellTide stores only a keyed hash and cannot show it again.
• Rotate or revoke a key immediately if it may have been exposed.

Never put a private key in client-side JavaScript, a mobile/desktop binary, an extension, NEXT_PUBLIC_ or VITE_ configuration, a URL, or a request body.

See AI agents for LLM/tool integrations and API submissions for complete HTTP examples.

Auditing

TellTide records creation, rotation, revocation, authentication failures, scope denials, origin rejection, and credential usage without recording secret values or feedback content. Usage and activity are scoped to the credential's app.

Security audit records are retained for 90 days. Submission-source attribution is retained for 365 days; it stores pseudonymous keyed IP hashes, not raw IP addresses.