Authbound uses separate keys for server and browser code. Verification flows also need a built-in preset ID or a custom policy ID from your project.
Never expose a secret key in browser code, mobile apps, logs, or client-accessible configuration.

​
1. Copy keys and choose a policy ID

Open the Authbound dashboard, choose your project, and copy:
  • a test secret key that starts with sk_test_
  • a test publishable key that starts with pk_test_
Then choose a built-in preset such as pol_kyc_basic_eudi_v1, copy a custom policy ID from the dashboard, or create one with @authbound/server or POST /v1/policies. Use the same selected policy ID on the server and in the browser. Choose a policy that matches the credential type and fields your flow verifies. pol_authbound_pension_v1 is a pension example preset; it does not automatically match a custom credential definition. For a custom definition, create a matching policy and copy its ID into both environment variables. Secret keys are shown once when created. Save the value before closing the dialog; create a replacement key if it was not saved. Keep secret and publishable keys in the same project and environment. Use live keys only after your test flow works end to end.

​
Policy builder

Create a policy from your project’s Policies page. Start from a task, or use the advanced custom builder. Review the fields and requirements before saving: every selected field is required and returned to your API. Open the saved policy to inspect its requirements and copy its ID.

​
2. Add server environment variables

AUTHBOUND_API_URL is optional for SDKs because production defaults to https://api.authbound.io. Keeping it in examples makes the public origin explicit. AUTHBOUND_SESSION_SECRET encrypts the HttpOnly SDK session cookie used by framework route helpers. Use at least 32 random bytes. AUTHBOUND_WEBHOOK_SECRET verifies webhook signatures from Authbound. You need it when your app receives webhook events, such as /api/authbound/webhook in Next.js or Nuxt, or /api/authbound/callback for Express or Hono mounted at /api/authbound. Built-in presets work across projects and may not appear in your project’s policy list. Custom policies are project-owned; copy their IDs from the dashboard or create them with @authbound/server or POST /v1/policies.

​
3. Add browser environment variables

Use the prefix expected by your framework.

​
4. Use the right auth method

Server requests use your secret key:
Only sk_test_* and sk_live_* values are accepted. All of these return 401: See Errors for fixes. Secret keys can be scoped. Policy create requires policies:write; policy list and get require policies:read. Other server SDK calls use the scopes configured on the key in the Authbound dashboard. Client status requests use the short-lived client token returned by the verification create call:
The Authbound browser SDK handles status headers for you.