Skip to main content
EthioReview issues one API client per integration. Each client generates three linked credentials. Use the right credential for where your code runs.

​
Credential types

​
Publishable key (widget embeds)

Copy from Integrations → API Clients in the dashboard. Pass it to the SDK as publicKey or publishableKey:
The SDK sends it as the X-Widget-Key header on every public widget request.

​
Secret key (server integrations)

Use Authorization: Bearer sk_live_* for partner API routes such as POST /partner/reviews. Keep secrets in environment variables on your server only.

​
Client ID

Derived from the secret key prefix. The backend uses it for internal lookups. You do not pass cli_* in widget embeds.

​
Origin allowlist

Every API client has an allowedOrigins list. Browser requests must come from a matching domain (checked via Origin or Referer).
  • Add every production, staging, and preview domain before go-live
  • An empty allowlist blocks all widget traffic
  • Local dev: include http://localhost:3000 (or your dev port)

​
Environment matching

A sandbox key cannot resolve a production widget, and vice versa.

​
Key rotation

Rotating an API client secret also rotates the publishable key and client ID together. Update every embed after rotation.

​
Security checklist

  • Never commit pk_* or sk_* to public repositories — use environment variables
  • Never embed sk_* in React, HTML, or mobile app bundles
  • Prefer React or Web Component over iframe unless CSP requires isolation
  • Restrict allowedOrigins to domains you control
Widget registry → · Sandbox testing →