Knock: Auth & Environment Keys
Docs-backedAPI keys are per-environment (development, production). Secret keys for server-side API calls (workflow triggers, user management). Publishable keys for client-side SDK access (feed reads, preference updates). Secret keys are passed via Authorization: Bearer header. The secret/publishable key split ensures client-side code can't trigger workflows. Environment isolation prevents development triggers from reaching production channels. User tokens (signed JWTs) authenticate individual users for client-side operations. For agents, using secret keys for server-side workflow triggers and publishable keys for client-side feed access provides appropriate separation. No OAuth for third-party integrations. Token signing uses the secret key.