Project Setup

Projects, API keys, environments, and how to point your SDK at the right source.

Projects

A project isolates all of your data in one place. Every event, user, and configuration is scoped to a single project, which keeps unrelated apps and services from mixing. Create one project per app or service you want to track.

API keys

Each project authenticates requests with an API key. Keys start with vk_ and are generated in the dashboard. Every request the SDK makes is scoped to the authenticated project, so a key only ever sees that project's data.

Environments

Keys are created for a specific environment so you can keep traffic from your different deployments separate.

Production

Use for real user traffic. Put production keys only in your server environment and keep them out of client code entirely.

Development

Use for local development and testing. These keys keep your sandbox data from mixing with real production events.

Preview

Use for staging or preview deployments, such as the temporary environments you stand up for each pull request.

Key security

API keys are credentials. Treat them like passwords, and structure your keys so you can tell which environment and platform produced a given request.

The secret is shown once

When you create a key, the full secret is displayed exactly once. If you lose it, generate a new key rather than trying to recover the old one.

Identify keys with keyPrefix

Each key has a keyPrefix, the first seven characters. Use it as a safe way to reference and label a key in your project without revealing the secret.

Platforms

When you create a key, choose the platform it will run on: node, browser, react, next, or other. The platform influences the defaults and scopes applied to that key. A server key and a browser key for the same project should be created separately so their scopes can differ.

Configure the source

The SDK attributes events to a source. Configure it on the client so every event is tagged with the environment it came from. This example uses the Node.js SDK.

import { Vanta } from '@vanta-dev/node'

const vanta = new Vanta({
  apiKey: process.env.VANTA_API_KEY,
  source: process.env.NODE_ENV,
})

You can also set it per call, which overrides the client default for that event.

await vanta.track({
  event: 'user.signup',
  userId: '123',
  source: 'production',
})