# Keys and secrets

Keep tracking keys private and replace a lost or exposed connection.



## What goes where [#what-goes-where]

| Value                     | Allowed location                                                |
| ------------------------- | --------------------------------------------------------------- |
| Meta Pixel ID             | Browser configuration; public identifier.                       |
| Tyton browser key (`pk_`) | Browser script or browser SDK configuration.                    |
| Tyton server key (`sk_`)  | Private backend environment and authorized agent configuration. |
| Meta CAPI token           | Tyton’s secure token input. Never browser code.                 |
| Pairing code              | Your intended agent connection; single-use, 15-minute expiry.   |

The browser key lets your website send browser events; it cannot manage your paid setup. A server key grants access to a Tyton site. Keep it out of shared files, screenshots, terminal output, and URLs.

## Replace a connection [#replace-a-connection]

1. Open the **Integrations** page in your Tyton dashboard and find the key under **Connected apps and keys**.
2. Select **Revoke** for the lost or exposed key. Generate a new connection for the intended agent and configure its returned key privately.
3. Ask the newly connected agent to read setup progress and confirm it names the right site. Update any backend you control that used the old key.

## Success check [#success-check]

Check that the old key shows as revoked and the new agent can connect. Removing a setting from your editor does not revoke its key. Events already accepted for delivery may still finish.

## Token and data handling [#token-and-data-handling]

For an exposed Meta token, replace or revoke it through Meta and save the replacement using [CAPI setup](/docs/meta/conversions-api-token). Tyton encrypts stored Meta tokens; it does not reveal them again.

Tyton hashes identity fields before putting events in its delivery queue. It uses raw IP addresses, browser user-agent details, and Meta cookie values only briefly for delivery and leaves them out of diagnostic records. A hash is still personal data in some contexts. Keep customer identity out of event IDs, URL paths, screenshots, and support messages.