Authentication
ChatHQ uses publishable keys for authentication. You can use them for both the embeddable widget and for API access.
Publishable key
Your publishable key is available in Workspace Settings → Publishable Keys. It is safe to use in:
- Widget snippet — The embeddable widget sends the publishable key with each request. It is designed for client-side use.
- API calls — For server-to-server integration, use the publishable key in your backend. Send it via
X-API-Keyheader orAuthorization: Bearer <key>.
We use the term "Publishable key" (not "API key") for this key. It is the same key for both widget and API.
Widget vs API
| Use case | Where to use the key | Allowed domains | |----------|----------------------|-----------------| | Embeddable widget | In the snippet on your website. The widget sends it with each request. | Yes. Backend only allows requests from domains you added. | | API (server-to-server) | In your backend code. Call our REST API with the key in the header. | No. API calls from your server are not restricted by domain. |
Embedding: domain restriction
When using the embeddable widget, our backend validates that requests come from allowed domains you configured. Add your domains in Workspace Settings. Requests from other domains are rejected.
When using the API from your server, there is no domain restriction. Use your publishable key and call our endpoints from your backend.
Headers
X-API-Key: YOUR_PUBLISHABLE_KEY
Or:
Authorization: Bearer YOUR_PUBLISHABLE_KEY
For the widget, use the publishable key in the snippet—it is safe for frontend use. For API, use it only from your server. Never expose secret keys in frontend code.
Was this article helpful?