Events
Data privacy
What to put in SDK keys, traits, and event properties.
Last updated on
SDK keys are either server secrets or public client keys, never both. A client key in a browser can only call public evaluation and ingestion for that environment. It still authenticates. Rotate it if a leaked build must be cut off.
Store the server key in a secret manager. Treat the client key as public.
Do not send passwords, access tokens, or raw payment data in properties. Prefer stable ids. The public flag endpoint ignores a fixed set of sensitive trait names. Do not rely on that filter as your only control: do not send the secret in the first place. Ingestion stores the JSON you send.
Was this page useful?