Skip to main content
Logo.dev gives you two keys. The publishable key works only on the Logo.dev CDN and is safe in client code. The secret key works only on the Logo.dev API and stays on your server.

Get your API keys

Your dashboard has a publishable key for the Logo.dev CDN and a secret key for the Logo.dev API. Every plan includes both.

​
Test keys

Logo.dev has no test or sandbox keys. Use your publishable and secret keys while you develop. The publishable key is safe in client code, so you can ship it in a browser or mobile build.

​
Key types

Each key works on its own host only. A secret key on the CDN, or a publishable key on the API, returns 401.

​
Publishable key (pk_)

Put the publishable key in the image URL:
You can ship this key in client code. It cannot read brand data or spend API credits, because the API rejects it. To stop other sites from using it, turn on domain restrictions.

​
Secret key (sk_)

Send the secret key from your server on every API request:
Never put this key in a browser, a mobile app, or a public repository. Anyone with it can spend your API credits.

​
Domain restrictions

Domain restrictions limit your publishable key to the sites you list. Logo.dev compares the host in each request’s Referer header with your list. A request from any other host returns 401. Secret key requests are not restricted.
With domain restrictions on, a request with no Referer header returns 401. Make sure your pages send the header before you turn restrictions on.

​
Turn on domain restrictions

1

Open your key

Go to API keys in the dashboard and open your key.
2

Turn on the restriction

Turn on Allowed domains only.
3

Add your domains

Enter one domain per line. Add localhost if you develop locally.
4

Save

Click Save and close.

​
Domain format

  • example.com matches example.com only.
  • *.example.com matches example.com and every subdomain, such as app.example.com.
The match ignores the port and the path, so localhost covers localhost:3000.

​
Make sure your pages send a Referer

Browsers send the Referer header by default, but a strict Referrer-Policy removes it. These policies work with domain restrictions: To set the policy for a whole page, add a meta tag to the <head>:
To set it for one image, use the referrerpolicy attribute:
In Next.js, set the header in next.config.js:
To test, open the Network tab in your browser’s developer tools and load a page with a logo. Select an img.logo.dev request and confirm that its Referer header shows your domain.

​
Key rotation

To rotate your keys, create a new key pair and move your app to it:
1

Create new keys

On the API keys page, click Create API keys.
2

Deploy the new keys

Replace the old keys in your app and your server, then deploy.
3

Disable the old keys

Open the old key and click Disable keys. New requests with those keys fail at once. Logo images that browsers and the CDN already cached can still show until their cache expires.
On a team, only an admin can create keys. If you cannot create keys, contact support@logo.dev.