Skip to main content

Install

Keys

Publishable key

Starts with pk_. Safe to expose in the browser. Used by the React provider to identify your agent.

API key

Starts with sk_. A server secret used to mint sessions. Shown once, so store it safely and never ship it to the browser.
Find both keys in the portal under your agent’s Deploy step at https://portal.usemoss.dev/fa.
Never ship the sk_... API key to the browser. Keep it in server-side environment variables only.

Environment variables

Keep the API key in a server-side environment variable so it never reaches the browser. The token route reads it as MOSS_FA_API_KEY.
The publishable key is browser-safe. Pass it to the provider directly, or read it from a NEXT_PUBLIC_ variable if you prefer. See React components.

Next steps

Server token route

Create the server route that mints a short-lived session for the browser.