Settings
Feedback widget & API
Issue and manage keys for the feedback widget and the Feedback API: pk_live_* publishable keys for browsers, sk_live_* secret keys for servers.
The Widget & API section (Settings → Integrations & Data → Widget & API) is where admins and owners issue the keys that let your product send feedback into ProductOS: through the embeddable feedback widget, or with your own code through the Feedback API.
What you'll see
- Install snippet: the widget's script tag, pre-filled with your first active publishable key's prefix.
- Publishable keys: name, displayable prefix (
pk_live_xxxx…), allowed origins, last used, revoked flag, and New key. - Attribution: whether the widget footer's "Powered by ProductOS" link is shown.
- Feedback API: a starter request and the Secret keys list (name, prefix
sk_live_xxxx…, last used), with New secret key.
Active keys are listed first; revoked keys stay below them for history.
Two kinds of key
Publishable (pk_live_) | Secret (sk_live_) | |
|---|---|---|
| Used by | The widget, and browser code calling the Feedback API | Your servers calling the Feedback API |
| Safe in customer-facing code | Yes | No |
| Origin allowlist | Required | None; requests with an Origin header are refused |
| Can submit | Yes | Yes |
| Submissions linked to accounts automatically | No | Yes |
| Can read submissions back and list a person's submissions | No | Yes, for Feedback API submissions only |
Neither kind can read anything else in the workspace. For general API access, use an API token.
Issuing
- Name: what the key is for (e.g. "Marketing site", "Production backend"). One key per app or environment makes rotation painless.
- Allowed origins (publishable keys only): a comma-separated host list. Supported shapes:
- Host with port (
localhost:3000): that port only - Host only (
example.com): any port - Wildcard subdomain (
*.vercel.app): any subdomain *: any origin (mostly for local development)
- Host with port (
The full key shows exactly once on creation. Copy it immediately; only a hash and a short display prefix are stored. Put secret keys in your server's secret manager, never in browser or mobile app code.
Origin enforcement
For publishable keys, the widget endpoint and the Feedback API check the request's Origin (or Referer if Origin is missing) against the key's allowed origins. A mismatch returns 403 forbidden with the rejected host echoed back for debugging. Edit a publishable key's origins with the pencil icon; secret keys have none to edit.
Rotating
Issue a new key, deploy it (update the embed snippet or your server's secret), then revoke the old one. There is no grace period: once revoked, a key returns 401 on its next request.
Related
- Feedback API: submitting feedback and NPS scores from your own code
- Public feedback widget: embedding the script
- Authentication: API tokens (
pos_live_*) for everything else