Publishable tokens begin with pk_ and can be used only for image delivery and limited browser-safe operations. Treat referrer restrictions as an abuse control, not as proof of identity.
Secret keys begin with sk_ and belong in an Authorization bearer header. They are shown once when created and stored as hashes. Rotate a key before revoking its predecessor to avoid downtime.
curl -H "Authorization: Bearer sk_live_••••" \
https://api.brandrelay.co/v1/logos/linear.app