Use the right credential
| Credential | Where it belongs |
|---|---|
| SDK key | App-scoped telemetry/configuration client. It is a public app credential and cannot authorize payment/admin operations. |
| Apple .p8 private key | Server-side store setup only. Keep it out of mobile bundles, source repositories, telemetry and screenshots. |
| Account session | Authenticated dashboard operations; HttpOnly/SameSite cookie boundary. |
| Google store credentials | Server-side provider-specific configuration. Never embed in an SDK. |
Manage consent explicitly
Both source SDKs initialize consent as false. Your app decides when tracking is permitted, then calls setConsent(true). Calls that track, expose an experiment or obtain an assignment require consent as enforced by the client. Configuration delivery is separate. setConsent(false) clears the persisted event queue and stops future tracking until re-enabled.
Organization and app boundaries
Organization membership controls access. Workspaces classify apps inside that boundary; they do not replace membership. SDK keys resolve their organization/app on the server. Dashboard writes recheck roles; Read only collaborators cannot mutate application data. Owners and self access are protected in collaborator management.
Protect your account
Google sign-in and password sign-in are supported. Account → Security supports a chosen authenticator or passkey method with recovery codes; enrollment is user initiated. Save recovery material privately. Email verification and password-recovery workflows remain unavailable; do not assume access can be recovered by an unimplemented email flow.
Transport and reporting trust
Use HTTPS for production. Native SDKs allow limited loopback/emulator HTTP exceptions for development. Telemetry remains untrusted input: SDK trial signals, installation counts and design previews must not be used as proof of a validated purchase or entitlement.