App key, signing secret and CLI key: the differences

Each App gets a public key when it is created. The signing secret only exists once the webhook is created. Only the key may appear in your site code.

• App key: it names your App in the install code and is safe to share. It is in App settings > Developers > Getting started and does not change.
• Signing secret: it signs each webhook call. It is created with the first webhook address, in App settings > Developers > Webhook, and stays on your server.
• CLI key: private, it starts with zk_cli_. It lets the Zean CLI get the App’s events on a developer’s computer. It is never the App key. Create it with “Create a CLI key”, in App settings > Developers > Webhook > “CLI key”.
• Listen secret: it signs the calls the Zean CLI forwards, in place of the signing secret. The command prints it; it changes when the CLI key is regenerated.
• Verified Contacts: no secret. Your App gives the signed-in person’s user ID, see the article “Verify your Contacts’ identity”.

Regenerate the signing secret

If the secret may have leaked, click “Regenerate” in the Webhook section, then update your server right after: webhook calls are signed with the new secret as soon as it is regenerated.

Regenerate the CLI key

If the CLI key may have leaked, click “Regenerate” in “CLI key”, then confirm. Every running Zean CLI stops at once and the Listen secret changes: your developers run the Zean CLI again with the new key.

Developers, with its Getting started, Domain, apps and pages and Webhook pages, is for Admins and the Owner only. Where the keys and the secrets go in your code: Documentation > Keys and secrets.