> ## Documentation Index
> Fetch the complete documentation index at: https://www.logo.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# API keys
> Guide to Logo.dev API keys. Learn the difference between publishable and secret keys, domain restrictions, and how to implement authentication correctly.
View and manage your API keys in the [Logo.dev
dashboard](https://www.logo.dev/dashboard/api-keys).
Logo.dev provides two types of API keys. Publishable keys are automatically secured for safe client-side use, while secret keys require traditional server-side protection.
## Key types
### Publishable key (`pk_`)
Use anywhere: browsers, mobile apps, client-side code. Only works with `img.logo.dev`.
**These keys are protected automatically.** You can expose one in client code without putting your account at risk.
```html theme={null}
```
### Secret key (`sk_`)
Server-side only. Required for search, describe, and other API endpoints. Never expose this key.
```javascript theme={null}
// Server-side only
const response = await fetch("https://api.logo.dev/search?q=nike", {
headers: {
Authorization: `Bearer LOGO_DEV_SECRET_KEY`,
},
});
```
## How we protect publishable keys
Even when your publishable key is copied, blocked traffic is never billed. We validate every request against several signals before it counts against your quota:
* **Endpoint restriction:** publishable keys only work with the image CDN.
* **Anomaly detection:** usage that doesn't match your normal traffic gets flagged.
* **Origin blocking:** suspicious referrers and excessive volumes are blocked before they count.
## Domain restrictions
For additional control, you can restrict your publishable key to specific domains. When enabled, only requests with a matching `Referer` header will be allowed.
### How to enable
1. Go to [API Keys](https://www.logo.dev/dashboard/api-keys) in your dashboard
2. Toggle **Allowed Domains Only**
3. Add your domains, one per line
4. Click **Save Changes**
### Domain format
* `example.com`: matches only `example.com`
* `*.example.com`: matches all subdomains, like `app.example.com` and `www.example.com`
**Set up referrers before enabling.** Once domain restrictions are enabled,
requests without a `Referer` header (direct traffic) will be blocked. Make
sure your application sends referrer data before turning this on.
### Ensuring your app sends referrer data
Browsers send the `Referer` header automatically for most requests, but some configurations strip it.
#### Check your Referrer-Policy
The `Referrer-Policy` header controls what referrer information is sent with requests. These policies work with domain restrictions:
| Policy | Works? | Notes |
| --------------------------------- | ------ | ------------------------------------------------ |
| `strict-origin-when-cross-origin` | ✅ | Modern browser default. Sends origin cross-site. |
| `origin` | ✅ | Always sends origin (recommended for APIs). |
| `origin-when-cross-origin` | ✅ | Sends origin for cross-origin requests. |
| `unsafe-url` | ✅ | Sends full URL (not recommended). |
| `no-referrer` | ❌ | Never sends referrer. Will break restrictions. |
| `same-origin` | ❌ | Only sends for same-origin. Will break. |
#### HTML meta tag
Add this to your `` to ensure referrers are sent:
```html theme={null}
```
#### Next.js configuration
Add referrer headers in `next.config.js`:
```javascript theme={null}
module.exports = {
async headers() {
return [
{
source: "/:path*",
headers: [
{
key: "Referrer-Policy",
value: "strict-origin-when-cross-origin",
},
],
},
];
},
};
```
#### Per-image referrer policy
You can also set the policy on individual images:
```html theme={null}
```
### Testing your setup
Before enabling domain restrictions:
1. Open your browser's developer tools (Network tab)
2. Load a page with Logo.dev images
3. Click on an `img.logo.dev` request
4. Check that the `Referer` header is present and shows your domain
If no `Referer` header appears, check your `Referrer-Policy` settings.
### What gets blocked
When domain restrictions are enabled:
* ✅ Requests from allowed domains
* ❌ Requests from unlisted domains
* ❌ Requests with no `Referer` header (direct access, some privacy tools)
* ❌ Requests from `localhost` (unless explicitly added)
Add `localhost` and `*.localhost` to your allowed domains during development.
## Key rotation
Need to rotate your keys? Contact [support@logo.dev](mailto:support@logo.dev) and we'll generate new keys for you.