API keys

Create, list and revoke keys in the app, under API keys.

plx_<id>_<secret>

The plaintext is shown exactly once, at creation — Evalwright stores only a hash, so a key you did not copy has to be replaced rather than recovered.

Environments

A key belongs to one environment of one project — development, staging, production, or one the project added — and reads every prompt of that project deployed there. The same code runs against each environment by swapping the key:

Key	resolve(SUPPORT_REPLY_ID) returns
development	the version deployed to development
staging	the version deployed to staging
production	the version deployed to production

A version deployed nowhere is a draft and no key can read it. A protected environment — production, to start with — is what your customers are served, so deploying there needs the promote permission, and your organization's approval policy when it has one.

Where to put it

A key is a bearer credential — anything holding it can read every prompt deployed in its environment. Keep it on the server.

Do	Don't
Read it from a secret store at startup	Ship it in frontend code — a key in a bundle is published
Give each environment its own key	Commit it — committed keys are found automatically, and the cleanup is a rotation

const client = new EvalwrightClient({
  apiKey: process.env.EVALWRIGHT_API_KEY!,
  baseUrl: process.env.EVALWRIGHT_BASE_URL!,
});

Rotation

Create the new key, deploy it, then revoke the old one. Revocation takes effect on the next request, and a realtime stream the key holds open is closed at once — no grace period, which is what you want the day a key leaks and not mid-deploy.

Each key records its last use, so a key nothing touches is safe to revoke.