API keys and presigned access
Manage your credentials in the rrweb Cloud dashboard.
| Credential | Where it may run | Capability |
|---|---|---|
Public write key (public_key_rr_*) | Browser or server | Create recordings, ingest events, and attach browser-visible metadata |
Private API key (secret_key_rr_*) | Trusted server only | Full read and write access, including ingestion, metadata, retrieval, and presigned access |
| Presigned URL/token | Untrusted viewer for one scoped resource | Read the signed recording resource until expiry |
The public write key is the recommended credential for browser ingestion. The private API key has full read and write access and is a server secret for trusted servers. Its larger blast radius makes strict storage and rotation especially important: Never expose a private API key in browser code. Use a scoped presigned URL/token for a replay viewer, player, screenshot, or other untrusted consumer.
What is the public write key for?
The public write key (public_key_rr_*) is safe to expose in browser code and can create recordings, ingest events, and attach browser-visible metadata, but it cannot read recordings.
It is designed to be visible in browser code and may also be used by a server-side recorder.
Use it to:
- create a recording by ingesting rrweb events;
- stream or batch event writes; and
- attach browser-visible, searchable metadata to that recording.
It does not grant read access to recordings. Configure it in the Browser Client or send it as Authorization: Bearer public_key_rr_your_key to a documented write operation.
What is the private API key for?
The private API key (secret_key_rr_*) has full read and write access and must stay in a trusted server environment; never expose it in browser code.
It carries all four recording read and write scopes. Store it only in a trusted server environment, secret manager, or similarly protected runtime.
Use it from that trusted server to:
- list and search recordings or replay groups;
- read recording events and metadata;
- create recordings, ingest events, and write metadata;
- retrieve recording statistics; and
- request responses containing presigned access links.
Send it as Authorization: Bearer secret_key_rr_your_key. Never log it, embed it in shipped JavaScript, place it in HTML, or send it to an untrusted viewer.
What is a presigned URL/token?
A presigned URL/token is generated through a private-key-authenticated listing or recording-detail request with signed URLs enabled. It is scoped to the returned recording or replay resource and stops working after its expiry.
Generate presigned links on a trusted server, then give the viewer only the returned link. Treat the full URL as sensitive until it expires: do not edit its path or signature parameters, and avoid leaking it through logs or analytics.
See Authentication for transport-specific guidance and the rrweb Cloud API overview for complete requests.