Publishable keys
Show live data on public pages without a backend, using an anonymous, read-only publishable key.
A publishable key lets a page or app read live data without signing anyone in and without a backend: a live scoreboard, a delivery tracking link, a public status page.
The key is public by design. Anyone can copy it from your page, so it can only ever read the topics you chose, and it never names a user.
Set it up
- In the segment's Settings, under Who can connect, turn on Allow anonymous connections. You can also cap how many anonymous connections may be open at once.
- On the Publishable keys tab, choose Add key. Give it a name (e.g. "Public scoreboard"), the topic
patterns it may read (e.g.
scores/>, withsubscribe) and, optionally, an expiry date. - Copy the key. It looks like
rte_pk_scoreboard.4f1c….
Use it
import { Folkways } from '@folkways/realtime';
const client = new Folkways.Realtime({
url: 'https://rte.example.com',
publishableKey: 'rte_pk_scoreboard.4f1c…',
});
await client.connect();
const match = client.topic('scores/match-7');
match.subscribe();
// Show every current value, and update when they change.
match.values('score').subscribe(() => {
for (const [key, msg] of match.values('score')) render(key, msg.data);
});The SDK trades the key for an anonymous token at the node, and trades it again before the token expires. Your code doesn't change.
What it can and can't do
| Can | Can't |
|---|---|
| Subscribe to the topics the key allows | Publish, set kv values or send signals |
| Receive history and current values | Name a user: session.identity is null, session.anonymous is true |
Your server writes to those topics instead, with rte.publish(),
so the topic rule must allow publish for your server while the key only grants subscribe.
Pause, revoke and expiry
On the Publishable keys tab you can pause, resume or revoke a key. Connections already using it are closed within about a minute:
| Key state | What the app sees |
|---|---|
| Paused | connect() fails, or the connection closes, with Suspended |
| Revoked or expired | The same, with AuthInvalid |
| Anonymous connections turned off | AuthInvalid |
If a key is misused, revoke it and ship a new one.
Need to publish or know who the user is?
Use a token signed by your backend instead: see Issue tokens from your backend.
rte_sk_ "secret keys" don't exist; the SDK refuses them.