Classify

Keys

Read the Botpoison Classify docs page "Keys" at https://botpoison.com/documentation/classify/keys.md
and use it to make this change in my project.
Use the stack this project already runs on, and ask me for my keys rather than inventing them.

Every Classify configuration has one key: a secret key for your server. Classify is never called from the browser, so there is no public key.

Secret key

The secret key starts with sk_. Your server sends it to /classify with each message. Keep it in your server's environment, never in client code, a public repository or a log line.

The dashboard shows the key once, when it is issued: copy it then. Botpoison stores only a keyed hash of it, so nobody can read it back later, including us. Afterwards the Settings tab shows its first and last characters, so you can tell which key a server holds. Lost the key? Reroll it.

Shell

# .env on your server
BOTPOISON_CLASSIFY_SECRET_KEY=sk_xxxxxxxx

Send it as an Authorization: Bearer header, an X-Api-Key header, or as secretKey in the body. If a request carries more than one, they must match, or it fails with a 401. See the REST API.

Rerolling the secret key

Reroll the secret key when it may have leaked, or when someone with access leaves. The settings and the history stay the same.

Open the configuration in the dashboard and go to its Settings tab.
Choose Reroll key and confirm.
Copy the new secret key into your server's environment. It is shown only this once.
Deploy, then send one message to check that it classifies.
Revoke the old key under Previous key, or let it run out on its own.

The old key keeps working for 1 hour

After a reroll, /classify accepts both keys for 1 hour, so you can deploy the new one without a gap. Then it rejects the old key with a 401 and Invalid secret key. If the key leaked, revoke the old one as soon as the new one is live: a revoked key is refused at once.

Test key

In development, use the secret key test. See Classify test mode for the messages that force each result.