Keys
What a key does, its types, where to keep it, and how to rotate or delete one.
A key links an app to your workspace on sdk.quranlab.ai. Copy prompt makes one for you and hands it to your coding assistant. You can also make one by hand under Keys.
What the key does
With the key, the SDK by itself:
- registers the app on its first launch: it appears under Apps, nothing to fill in;
- fetches its signed settings (Ed25519, checked against a key built into the SDK) at launch, when the app comes to the foreground and every minute while it is in use, so what you change on sdk.quranlab.ai reaches running apps within about a minute;
- downloads only the model files its device needs, checks every file against the signed manifest, keeps the exact CPU engine as the fallback, and switches to a new model version or build only at the start of a session;
- sends anonymous daily counters (every field) and grouped issue reports.
Types
A key's type is chosen when it is made and never changes.
| Type | For | The app is identified by |
|---|---|---|
apps |
iOS and Android | The bundle id, the Gradle applicationId |
web |
Browsers | The page's exact https origin |
desktop |
macOS, Windows and Linux | The macOS bundle id; the Windows package family name or AppUserModelID; the Linux reverse-DNS app id |
A web key is public by design: it works only from the origins you gave it, and each origin registers as its own app. An apps or desktop key can be restricted to your app's identity, so a copied key is useless in another app.
A key is for production or for development. A development and a production key for the same app is normal. A development key never counts in production analytics.
Where it lives
One key per app is the guideline. The full key is shown once, when it is made. Keep it out of your repository: a git-ignored properties file on Android, an xcconfig on Apple, an environment file on the web, the environment or your app's config file on Windows and Linux. Each quick start shows the place.
Rotating and deleting
Rotating gives you a new key with the same name and stops the old one at once. Apps still using the old key are refused by the server until they ship with the new one; a device that already has the model keeps working offline in the meantime.
Deleting a key stops it for good. Apps that use it need a new key.
In an organisation
Keys belong to a workspace, not to a person. In an organisation, owners and admins manage keys; developers create and use them. A key, with its apps and their history, can be moved from your personal workspace to an organisation you administer. A move is one way.