API keys
Secret and publishable keys, limiting a key to read-only, to named tables, to certain addresses and to an expiry, rotating with a grace period, and revoking.
Last updated September 17, 2026
On this page
Keys are managed on the API tab by the app's owner. Make one key per integration so you can revoke one without breaking the rest.
Two kinds
| Kind | Prefix | Where it lives | What it can do |
|---|---|---|---|
| Secret | pxa_sk_ | Your server. Never in a page. | Read and write every table, run functions. Refused if a browser presents it. |
| Publishable | pxa_pk_ | A page, a mobile app, anywhere public | Read tables whose read level is Public, on an app anyone can visit. Never writes, never sees who created a row. |
Creating a key
After the integration it serves, so you recognise it later.
Secret for a server, publishable for a page.
Read and write or Read only; an expiry (never, 1, 7, 30, 90 days or a year); the tables it may touch (none ticked means all); and optionally the IP addresses or CIDR blocks it may be used from.
The key is shown a single time. Praxivara keeps only a hash of it. If you lose it, make a new one.
Rotating
Rotate gives you a replacement straight away and lets you choose how long the old key keeps working: no time at all (use this if it leaked), an hour, a day or a week, so every integration can be switched over without a gap.
Revoking
Revoke a key and every call with it answers unauthorized from that moment. Nothing else about the app changes.
Seeing what a key does
The call log under Logs records the key used for every call, so you can see what each integration is doing.