> ## Documentation Index
> Fetch the complete documentation index at: https://docs.susaplay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Keep publishing credentials scoped and rotate them safely

## Key types

| Key               | Used for                        | Lives in          |
| ----------------- | ------------------------------- | ----------------- |
| Game key          | SDK init inside the game client | Game binary / env |
| Developer API key | CI/CD build uploads             | Pipeline secrets  |
| Admin credentials | Never used in games             | Admin panel only  |

## Rules

**Game key goes in the client.** Never put admin credentials or the developer API key inside game code — they have wider permissions.

In Unity the game key lives in the `PlatformConfig` asset, created via **susaplay → Create Config
Asset**. `SusaPlaySDK.Initialize()` reads it from there.

```csharp theme={null}
// Correct — the SDK reads the key from PlatformConfig
await SusaPlaySDK.Initialize();
```

Never hardcode the key in a script. Anything compiled into a WebGL build is readable by anyone
who opens the browser devtools, so treat the game key as public — it is scoped to a single game
and grants nothing beyond it.

**Separate production and test keys.** Keep a separate `PlatformConfig` asset per environment and
swap it at build time, so a test build can never talk to production:

```text theme={null}
Assets/SusaPlay/PlatformConfig.asset          # production
Assets/SusaPlay/PlatformConfig.staging.asset  # staging
```

## Generate or rotate a key

1. Developer Portal → your game → **Settings → API Keys**
2. Click **Generate New Key**
3. Copy immediately — shown once

After generating, update your build pipeline secrets before the old key is invalidated.

## If a key is exposed

1. Generate a new key immediately
2. Update secrets in all environments (CI/CD, staging, production)
3. Invalidate the old key from the API Keys page