Keys and credentials
How server keys and browser keys work.
Keys are created per workspace on the Credentials page. Name each key after the service that uses it, so revoking it is predictable. There are two kinds. A server key is for servers and collectors; it is rejected from web pages, so it can't leak through browser code. A browser key lists the websites allowed to use it and only works from them; it is rejected from servers and over gRPC. A key's websites can't be edited: create a new browser key and revoke the old one. Revoking a key stops the services using it immediately.