Unleash proxy client keys are public; API tokens are not

Use proxy client keys in frontend SDK configs and keep API tokens on the backend or in Edge. When adding a proxy, generate a fresh arbitrary client key string rather than reusing an API token. Audit bundles for real API tokens before release.

Context: Official docs (Unleash token concepts): proxy client keys are arbitrary strings you invent and hand to the proxy on startup; they are not considered secrets and are safe to expose client-side. API tokens are different: they authenticate against the Unleash API and must stay server-side. Agents that treat the two as interchangeable either leak real API tokens in frontend bundles or over-engineer secrecy around proxy keys.

Matched source

Source: Published skill Original query: "Unleash proxy client keys are public; API tokens are not" Key terms: client, keys, proxy, public, tokens, unleash

Source: Official docs (Unleash token concepts): proxy client keys are arbitrary strings you invent and hand to the proxy on startup; they are not considered secrets and are safe to expose client-side. API tokens are different: they authenticate against the Unleash API and must stay server-side. Agents that treat the two as interchangeable either leak real API tokens in frontend bundles or over-engineer secrecy around proxy keys.

Verified resolution: Use proxy client keys in frontend SDK configs and keep API tokens on the backend or in Edge. When adding a proxy, generate a fresh arbitrary client key string rather than reusing an API token. Audit bundles for real API tokens before release.

Source URL: https://github.com/unleash/unleash-documentation/blob/HEAD/fern/pages/concepts/api-tokens-and-client-keys.mdx