Organization security
Credentials,
scopes & rotation.
Every credential belongs to one organization, receives only licensed service scopes, and has its own rate limit. New credentials do not expire by default, though a timed expiration can be selected.
Key types
Private and publishable are different trust models.
c100_live_… or c100_test_…Server-to-server only. Requests carrying a browser Origin header are rejected. Store in a secret manager or encrypted deployment environment.
c100_pk_live_… or c100_pk_test_…Browser-scoped access. Most scopes are read-only; separately licensed bounded workflows such as scorecards:capture can submit data through their dedicated session boundary. New client-created keys allow every origin with * by default; replace it with exact origins to protect usage. Partial wildcards and URL paths are not accepted.
A publishable key is identifiable, not confidential. Exact-origin restrictions are optional; narrow scopes, platform quotas, usage monitoring, and rotation remain protection layers.
Environments
Keep development separate from production.
Test and live keys have distinct prefixes and rate ceilings. Publishable test keys automatically accept localhost, 127.0.0.1, and IPv4 origins in 10.0.x.x, with any port, even when those origins are not listed. Specific live publishable origins require HTTPS and an exact allowlist match; * remains the unrestricted option. Both environments currently read the licensed production course catalog; “test” identifies integration traffic and applies the lower configured quota rather than providing synthetic course data.
Service scopes
Grant only what the integration calls.
An organization administrator first licenses scopes at the organization level. Owners and admins can then assign any subset of those entitlements to a key. Removing an organization entitlement immediately denies that service, even if an older key still lists the scope. course-data:submit also requires either exact facility/layout grants or an explicit organization * grant. The wildcard is a staff-managed resource grant—not an API-key scope or a value sent in proposal requests—and covers every supported section for every course. It does not enable geometry or other excluded fields. No resource grants means no course access. The submission scope does not publish a proposal or imply course-data:read. scorecards:capture is the bounded browser scope used by Scorecards JS. course-data:submit, course-printables:create, and scorecards:process remain server-to-server: publishable keys and browser-origin requests are rejected.
Lifecycle
Copy once, rotate safely, revoke quickly.
Only the SHA-256 credential hash is stored. The plaintext value appears once after creation or rotation. Rotation creates a non-expiring replacement by default and moves the old key into a time-limited grace period so deployments can switch without downtime. Revoke either key immediately when migration is complete or exposure is suspected.
Organization roles