A leaked publishable key isn't a disaster: it can only load your widget config and submit enquiries. Still, if a key is being misused (spam leads, another site embedding your widget), rotate it. Setting allowed domains first is often enough on its own.
Rotating the publishable key
- Open Widget, open any form and click Your Innkept code.
- Next to the publishable key, click Rotate.
- Copy the updated Innkept code and replace the old code on every page of your site that uses it.
Rotation takes effect immediately. The old key stops working the moment you click Rotate, and there is no overlap period. Until the new code is live on your site, the widget there shows "This booking form isn't available right now." Have the new code ready to paste before you rotate.
Your allowed domains, widget versions and settings carry over to the new key. Only the
data-key value in your code changes.
We never auto-rotate
Some platforms force key rotation every N days. That just trains people to deploy under pressure. Rotate when there's a reason, and not otherwise.