Store full secret keys only on trusted servers. BrandRelay stores hashes and a non-secret prefix, supports revocation, and keeps ingestion/admin scopes separate.
Public CDN URLs are reusable and need no customer token. Metering applies to API and discovery use, not to cached copies of a public asset.
curl -H "Authorization: Bearer sk_live_••••" \
+ https://api.brandrelay.co/v1/brands/by-domain/linear.app