Key types

| Type | Prefix | Where it lives | Endpoints it can hit | | --- | --- | --- | --- | | Publishable | gflux_pub_ | Browser code, public sites | POST /v1/events, POST /v1/events/batch | | Server | gflux_secret_ | Backend services | Publishable's set + POST /v1/identify/alias, POST /v1/profiles/{id}/erase |

Using a publishable key on a server-only endpoint returns 403 wrong_key_type so you find out at the request site, not in production traffic.