Classify

# Keys

Every Classify configuration has one key: a secret key for your server. Classify is never called from the browser, so there is no public key.

## Secret key

The secret key starts with `sk_`. Your server sends it to `/classify` with each message. Keep it in your server's environment, never in client code, a public repository or a log line.

The dashboard shows the key once, when it is issued: copy it then. Botpoison stores only a keyed hash of it, so nobody can read it back later, including us. Afterwards the Settings tab shows its first and last characters, so you can tell which key a server holds. Lost the key? Reroll it.

Shell

```bash
# .env on your server
BOTPOISON_CLASSIFY_SECRET_KEY=sk_xxxxxxxx
```

Send it as an `Authorization: Bearer` header, an `X-Api-Key` header, or as `secretKey` in the body. If a request carries more than one, they must match, or it fails with a 401. See the [REST API](https://botpoison.com/documentation/classify/rest-api/).

## Rerolling the secret key

Reroll the secret key when it may have leaked, or when someone with access leaves. The settings and the history stay the same.

- Open the configuration in the dashboard and go to its Settings tab.
- Choose `Reroll key` and confirm.
- Copy the new secret key into your server's environment. It is shown only this once.
- Deploy, then send one message to check that it classifies.
- Revoke the old key under Previous key, or let it run out on its own.

The old key keeps working for 1 hour

After a reroll, `/classify` accepts both keys for 1 hour, so you can deploy the new one without a gap. Then it rejects the old key with a 401 and `Invalid secret key`. If the key leaked, revoke the old one as soon as the new one is live: a revoked key is refused at once.

## Test key

In development, use the secret key `test`. See [Classify test mode](https://botpoison.com/documentation/classify/test-mode/) for the messages that force each result.