Challenge

# Keys

Every Challenge configuration has two keys: a public key for your page and a secret key for your server. Find both on the configuration's Settings tab in the dashboard.

## Public key

The public key starts with `pk_`. It sits in your page's markup or JavaScript, where anyone can read it. It can only request a challenge for its configuration. It never changes, so published pages keep working.

## Secret key

The secret key starts with `sk_`. Your server sends it to `/verify` with each solution. Keep it in your server's environment, never in client code, a public repository or a log line.

Send it as an `Authorization: Bearer` header, an `X-Api-Key` header, or as `secretKey` in the body. If you send more than one, the body key wins, then the bearer token. See the [REST API](https://botpoison.com/documentation/challenge/rest-api/).

## Rerolling the secret key

Reroll the secret key when it may have leaked, or when someone with access leaves. The public key, the settings and the history stay the same.

- Open the configuration in the dashboard and go to its Settings tab.
- Choose `Reroll key` and confirm.
- Copy the new secret key into your server's environment.
- Deploy, then submit your form once to check that it verifies.
- Revoke the old key under Previous key, or let it run out on its own.

The old key keeps working for 1 hour

After a reroll, `/verify` accepts both keys for 1 hour, so you can deploy the new one without a gap. Then it rejects the old key with `Invalid secret key`. If the key leaked, revoke the old one as soon as the new one is live: a revoked key is refused at once. Reroll again within the hour and only the key you just replaced keeps working; the one before it stops at once.

## Test key

In development, use the secret key `test`. See [Challenge test mode](https://botpoison.com/documentation/challenge/test-mode/) for the solutions that force each result.