# Credentials

Client Key evaluates, API Key peeks. Pass exactly one.

Construct the client with exactly one credential. Zero or both throws `SDK_CREDENTIAL_CONFIGURATION_INVALID` at construction, because the two unlock different methods and the client cannot guess which you meant.

| Option | Credential | Where it may live | Unlocks |
| --- | --- | --- | --- |
| `clientKey` | public Client Key (`pk_`) | browsers, mobile, servers: anything that evaluates | `evaluate`, `evaluateDetails`, `verify` |
| `apiKey` | secret API Key (`sk_`) | servers only; never ship it to a client | `peekVariant`, `verify` |

A server-side integration that fires Exposures uses a Client Key, not an API Key. The API Key cannot call `evaluate` or `evaluateDetails`. Client Keys are safe to use from servers, so present one on that path.

## What a rejected credential looks like

- [UNAUTHORIZED](/docs/error/UNAUTHORIZED): no credential, or one that could not be parsed.
- [CREDENTIAL_REVOKED](/docs/error/CREDENTIAL_REVOKED): known key, revoked. Revocation is immediate; it never degrades to cached service.
- [INSUFFICIENT_SCOPES](/docs/error/INSUFFICIENT_SCOPES): valid key without the scope this call needs. A Client Key holds only `evaluate`.
- [ORIGIN_NOT_ALLOWED](/docs/error/ORIGIN_NOT_ALLOWED): valid Client Key from an origin not on its allow-list.
- [APP_MISMATCH](/docs/error/APP_MISMATCH): the key belongs to a different App than the request addressed.

Source: https://splitch.dev/docs/sdk/credentials