Your two keys
One is safe to share. One is secret. Here's the difference.
Your account has two keys, and they do different jobs. It's worth a minute to know which is which — mixing them up is the one mistake that can cause trouble.
The secret key — starts with fm_live_
This is the one inside your connector link, the one you paste into your AI app. It can see everything: list your forms, read them, and check them. Treat it like a password. It goes in your own AI app and nowhere else.
The safe-to-share key — starts with fm_pub_
This one goes in a form on your website, so visitors can fill it in. That's all it can do — send you submissions. It can't read or open your forms. It's fine for anyone to see: even if they copy it, the worst they could do is send you a message through your own form.
Building the website form yourself (or with a developer)? Use the fm_pub_ key in the page —
never the fm_live_ one. And a heads-up for developers: putting a key in a VITE_…,
NEXT_PUBLIC_…, or REACT_APP_… variable does not keep it secret — those get baked into the
website for anyone to read. If a key can reach a web page, treat it as public.
Which goes where
Secret fm_live_ | Safe fm_pub_ | |
|---|---|---|
| In your AI app | ✅ yes | ❌ won't work |
| In a form on your website | ❌ never | ✅ yes |
| If someone gets hold of it | they can see your whole account | they can only submit to your forms |
If a key gets out
Make a new one from your dashboard's Danger zone. The old one stops working the instant you do — on purpose, because a leaked key shouldn't keep working for even a minute.
- New safe key → update your website forms with it.
- New secret key → paste the new connector link back into your AI app.
Either takes about a minute to fix. A leaked secret key you don't replace is the real problem.