# Symptom
Either the frontend fails with an invalid-key error, or Backend API calls return 401, right after keys were pasted or rotated.
# Confirm the cause
1. Publishable keys start with pk_ and belong on the frontend: ClerkProvider and NEXT_PUBLIC_ variables. They are safe to expose.
2. Secret keys start with sk_ and belong ONLY on the backend, for createClerkClient and direct Backend API calls. A secret key in a NEXT_PUBLIC_ variable ships it to every browser.
3. If the frontend complains: you likely pasted a secret key into the publishable slot, or there is a typo or stray whitespace.
4. If the Backend API 401s: you likely passed the publishable key where the secret key belongs.
5. Both keys must come from the SAME instance. A pk_test_ key paired with an sk_live_ key never works.
# Fix
- Put each key in its slot, trim whitespace, restart the dev server so env changes load, and re-check the prefixes.
# Verify
The frontend loads Clerk with no key error, and a Backend API call (for example fetching the user list) returns 200 with the secret key.