API keys

Ferry has two key types with intentionally different jobs.

Prefix	Scope	Where it belongs	What it does
pk_	One project	iOS, Android, Flutter, and React Native apps	Authorizes SDK link handling, matching, supported events, and optional client-created links
sk_	One workspace	A trusted server or an MCP client	Manages links, domains, and analytics across the workspace

Use pk_ in every SDK

The public project key is not a secret. Ferry expects it to be bundled with your app. It cannot perform unrestricted workspace operations, and each key resolves to exactly one project.

Use the key from the same project that owns your link hostname:

pk_test_xxx

Use environment-specific app configuration when you have separate development and production Ferry projects. A test build should not report activity to the production project.

Keep sk_ out of apps

An sk_ key authorizes control-plane operations and bypasses normal workspace role checks. Never place it in:

• Mobile source code.
• A compiled app environment file.
• An iOS property list or Android resource.
• React Native or Flutter application configuration.
• Logs, crash reports, screenshots, or example projects.

Use an sk_ key only from a trusted server or an MCP client you control.

Caution

Treat every sk_ key as a reusable credential. If one reaches a client app or a public repository, replace it immediately.

Common configuration mistake

If the SDK silently delivers no link, verify that its pk_ key belongs to the same Ferry project as the hostname being opened. A public key from another project cannot resolve or attribute that link.