Publishable keys

A secret key (up_live_…) is refused from a browser, because a key in a browser is visible to every visitor. For a username field that checks as the person types, make a publishable key (up_pk_…) instead.

What it can do

• Call /v1/check only. No batch, no feedback, no usage, no lists.
• From the origins listed on its project, checked against the browser’s Origin header, with CORS headers in the answer.
• At thirty requests a minute per address, on top of the plan’s own limit.

Setting it up

1. Add your site’s origin to the project in the dashboard: https://game.example, no path. Up to fifty.
2. Create a key of kind publishable.
3. Call from the page:

const res = await fetch('https://api.unprofane.com/v1/check', {
  method: 'POST',
  headers: { Authorization: 'Bearer up_pk_YOUR_KEY', 'Content-Type': 'application/json' },
  body: JSON.stringify({ text: username, context: 'username' }),
});

Games

Unity and Godot builds are not browsers, so the origin check cannot apply to them, and a key in a build is a key anyone can read. Check the final username from your own server with a secret key, and use the publishable key only for the live hint in the client. The Unity and Godot recipes show both halves.