Skip to main content
Every request carries one credential: your publishable key. Each operation’s Authorizations panel lists it.

​
The credential

​
Publishable key

Identifies your app to Calm. It ships in your client bundle, so treat it as public — it names your app rather than authenticating it. Issue keys from your Calm dashboard. The value looks like calm_public_live_… or calm_public_sandbox_…. Every key is pinned to an allowlist of HTTPS origins. Add your app’s origins before you go live: a live key with an empty allowlist rejects every request with 403 origin_not_allowed. Sandbox keys stay permissive while their allowlist is empty, so local development works without any setup. Requests must carry an Origin header. Browsers send it for you; outside sandbox, a request without one is rejected.

​
Failure modes