Organization security
Credentials,
scopes & rotation.
Every credential belongs to one organization, receives only licensed service scopes, and has its own rate limit. New credentials do not expire by default, though a timed expiration can be selected.
Key types
Private and publishable are different trust models.
c100_live_… or c100_test_…Server-to-server only. Requests carrying a browser Origin header are rejected. Store in a secret manager or encrypted deployment environment.
c100_pk_live_… or c100_pk_test_…Read-only browser access. Each scope requires separate browser entitlement. New client-created keys allow every origin with * by default; replace it with exact origins to protect usage. Partial wildcards and URL paths are not accepted.
A publishable key is identifiable, not confidential. Exact-origin restrictions are optional; narrow scopes, platform quotas, usage monitoring, and rotation remain protection layers.
Environments
Keep development separate from production.
Test and live keys have distinct prefixes and rate ceilings. Publishable test keys automatically accept localhost, 127.0.0.1, and IPv4 origins in 10.0.x.x, with any port, even when those origins are not listed. Specific live publishable origins require HTTPS and an exact allowlist match; * remains the unrestricted option. Both environments currently read the licensed production course catalog; “test” identifies integration traffic and applies the lower configured quota rather than providing synthetic course data.
Service scopes
Grant only what the integration calls.
An organization administrator first licenses scopes at the organization level. Owners and admins can then assign any subset of those entitlements to a key. Removing an organization entitlement immediately denies that service, even if an older key still lists the scope.
Lifecycle
Copy once, rotate safely, revoke quickly.
Only the SHA-256 credential hash is stored. The plaintext value appears once after creation or rotation. Rotation creates a non-expiring replacement by default and moves the old key into a time-limited grace period so deployments can switch without downtime. Revoke either key immediately when migration is complete or exposure is suspected.
Organization roles