API key security
How publishable and secret keys are issued, stored, and rotated.
ARCY issues two keys per integration:
Publishable key (pk_live_...): Safe in client-side code. Used to bootstrap sessions and identify your app.
Secret key (sk_live_...): Server-side and CLI only. Never sent to the browser. Required for the CLI's network commands: arcy push, arcy pull, arcy status, arcy log, and arcy rm.
Secret keys are encrypted at rest (AES-256-GCM), with support for encrypting them via AWS KMS instead of a local key, so the master key material itself can be managed and rotated inside AWS's key management service rather than an application-level secret.
The plaintext key is shown once at creation time; after that, only an explicit reveal action you trigger from the dashboard shows it again.
If a key is compromised, rotate it from your dashboard under Settings > API Keys. The old key is revoked immediately.
Your publishable key alone can't drain your AI credit budget: every session the SDK bootstraps also has to come from a verified origin and carry a signed session token before ARCY will bill against it. See Domain verification & session trust for how that works.
See Compliance at ARCY AI for certification status, DPA availability, and regulated-industry guidance.