Your server
Keys and secrets
The App key is public; the signing secret, the CLI key and the Listen secret stay private.
Updated October 28, 2026
Each App gets a public key when it is created. The signing secret only exists once the webhook is created, the CLI key once you create it. Only the App key may appear in your site’s or your app’s code.
| Name | Where it goes | Description |
|---|---|---|
| App key | appKey | Public. It names your App in the Install code and the SDKs. It is in App settings > General and does not change. |
| Signing secret | HMAC-SHA256 | Secret. It signs each webhook call. Created with the first webhook address. See Verify a webhook signature. |
| CLI key | --key | Private, shaped like zk_cli_…. It lets the Zean CLI receive the App’s events on your computer. It is never the App key. See Receive webhooks on your computer. |
| Listen secret | HMAC-SHA256 | Secret. It signs the calls the Zean CLI forwards, in place of the signing secret. The Zean CLI prints it at start. It changes only with the CLI key. |
Identifying your Contacts needs no secret: your app passes the chat the signed-in person’s ID. See Identify your Contacts.
Regenerate the signing secret
If the secret may have leaked, click “Regenerate” in App settings > Developers > Webhook, then update your server right after. Webhook calls are signed with the new one as soon as it is regenerated, new tries included.
Create or regenerate the CLI key
- Open App settings > Developers > Webhook > “CLI key”, then choose “Create a CLI key”.
- Copy it and keep it out of your code, for example in the
ZEAN_CLI_KEYenvironment variable on your computer. - If it may have leaked, choose “Regenerate” and confirm. Every running Zean CLI stops at once, and the Listen secret changes: run the Zean CLI again with the new key and update the Listen secret on your development server.
The Developers section is for Admins and the Owner only.