Keys
Secret sk_ keys stay on the server. Publishable pk_ keys belong in the browser. Live traffic needs a licensed site.
| Key | Prefix | Where | Header | Surface |
|---|---|---|---|---|
| Secret | sk_test_… / sk_live_… | your server | x-api-key (Monitor also accepts Authorization: Bearer) | https://abusegraph.com/api/v1/* |
| Publishable | pk_test_… / pk_live_… | browser / SDK | x-api-key or JSON publicKey | https://api.abusegraph.com |
| Site | hostname | server env + live header | x-abusegraph-site | licensed domain |
Test vs live
| Test | Live | |
|---|---|---|
| Key | sk_test_… / pk_test_… | sk_live_… / pk_live_… |
x-abusegraph-site | optional | required — DNS-verified hostname |
| Quota | unlimited test | plan live checks (Free: 1,000 / month) |
Live keys refuse localhost and unlisted hosts. Local tooling must use test keys.
Minimum env
ABUSEGRAPH_SITE=yourdomain.com
ABUSEGRAPH_CHECK_URL=https://abusegraph.com/api/v1/check
ABUSEGRAPH_SECRET_KEY=sk_test_…
ABUSEGRAPH_SECRET_KEY_TEST=sk_test_…
NEXT_PUBLIC_ABUSEGRAPH_PUBLISHABLE_KEY=pk_test_…Never invent live keys. Never commit secrets.
Account metadata
GET /api/v1/account with a secret key returns plan, usage, and domain metadata — see Account.