A key you can put in your page source
Publishable keys are meant to be visible. Domain-locked, rate-limited, and capped by an allowance — and a copied key is refused before it counts.
Anyone who opens your page source can read the publishable key. That is by design, and what follows is what happens when it is copied.
What protects it
- The domains you list. A key copied out of your page does not work from somebody else’s. Requests are checked against your allowlist.
- A per-key rate limit. One source cannot flood the key.
- Your monthly allowance, which is the real guarantee: consumption is capped rather than open-ended.
A request from an origin you did not allow is refused before it is counted, so traffic taken with a copied key never reaches your allowance.
What is not claimed
A hard rate limit is not claimed. The limiter is edge-local and best-effort — measured refusing 26 of 250 requests on one connection and 5 of 500 spread differently — so calling it a cap would be marketing rather than a fact. What bounds sustained use is the allowance.
Blocking malicious traffic is not claimed either. That is Cloudflare’s network doing its job in front of the platform, not a feature of it.
Manage keys
Create as many keys as you have places to use them, label them, set each one’s allowed domains, and revoke or rotate any of them independently — a leaked staging key and your production key are separate credentials and do not share a fate. Rotating issues the replacement first and leaves the old key working until you revoke it. There is no window where neither key serves.
Details in the quickstart.