# Keys and credentials

Keys are created per workspace on the Credentials page. Name each key after the service that uses it, so revoking it is predictable.
There are two kinds. A server key is for servers and collectors; it is rejected from web pages, so it can't leak through browser code.
A browser key lists the websites allowed to use it and only works from them; it is rejected from servers and over gRPC. A key's
websites can't be edited: create a new browser key and revoke the old one. Revoking a key stops the services using it immediately.