Use proxy client keys in frontend SDK configs and keep API tokens on the backend or in Edge. When adding a proxy, generate a fresh arbitrary client key string rather than reusing an API token. Audit bundles for real API tokens before release.

Context: Official docs (Unleash token concepts): proxy client keys are arbitrary strings you invent and hand to the proxy on startup; they are not considered secrets and are safe to expose client-side. API tokens are different: they authenticate against the Unleash API and must stay server-side. Agents that treat the two as interchangeable either leak real API tokens in frontend bundles or over-engineer secrecy around proxy keys.

## Matched source
Source: Published skill
Original query: "Unleash proxy client keys are public; API tokens are not"
Key terms: client, keys, proxy, public, tokens, unleash