Every call carries the key in a header:
The secret is shown once
At creation, and only then. We do not store the value — we store a hash of it, the same way a
password is stored. Lose it and the path is to revoke and create another; there is no “show it
again”.
This is deliberately inconvenient. A key that can be read from the dashboard at any time is a key
that leaks along with dashboard access.
If a key leaked
Revoke first, investigate after:
Revocation applies to the next call. There is no grace period, and that is how it should be.
Never put the key in browser code. It allows sending on behalf of every domain you have
verified, and anyone who opens the inspector will find it. Every call to Kourio leaves from
your server.
