# Client Key

URL: https://theelena.me/docs/avileo/tiendas/client-key
Text: https://theelena.me/docs/avileo/tiendas/client-key.txt
Description: Usa avileo_pk_... como identificador público seguro para tu storefront.
Context: environment=production; apiBaseUrl=https://tienda.theelena.me; activation=active; rubro=tiendas

# Client Key

The **Client Key** is a public key that identifies an Avileo business. It has this format:

```txt
avileo_pk_xxx...
```

You can place it in frontend code, public storefront environment variables, AI-agent prompts, or internal documentation. It is designed to be visible in the browser.

## What it allows

A Client Key enables public SDK capabilities:

- read the business public profile;
- list the catalog, categories, products, and public stock;
- create and update draft carts;
- look up orders or payments through a shared token;
- query service sessions when the business supports them.
- inspect the business's presentation-safe public image assets for storefront composition;

## What it does not allow

The Client Key **does not** create a dashboard session and **does not** authenticate an administrative user. It does not grant access to internal sales, private settings, full customer records, reports, or dashboard permissions.

If someone opens the Avileo dashboard, they still need to sign in with Better Auth and their normal permissions. The Client Key only resolves the business for public endpoints.

## HTTP header

The SDK automatically sends this header:

```http
x-avileo-client-key: avileo_pk_...
```

If you use direct HTTP, send it on every request to `/api/v1/public/sdk/*`.

## Rotation and revocation

You can create multiple Client Keys per business, for example one per storefront. To rotate a key:

1. generate a new key in the dashboard;
2. update the storefront or AI agent;
3. confirm traffic is using the new key;
4. revoke the old key.

When a key is missing, invalid, or revoked, the backend responds with 401 or an equivalent public error, and the SDK throws a typed error class.