Get your credentials

Configure hands out five credentials. Every integration path uses some of them, and none of them requires installing anything to obtain.

CONFIGURE_API_KEY=sk_...              # server only
CONFIGURE_PUBLISHABLE_KEY=pk_...      # safe in the browser
CONFIGURE_AGENT=your-agent            # safe in the browser
CONFIGURE_OAUTH_CLIENT_ID=oc_...      # safe in the browser
CONFIGURE_OAUTH_CLIENT_SECRET=ocs_... # server only, shown once

Two ways to get them. Both produce the same five values, and neither is a prerequisite for the other.

	From the dashboard	From the CLI
You install	nothing	nothing (npx fetches per run)
You get	the values on screen, to paste	the values written to .env
Use it when	your app has no Node project, or you would rather click	you are already in the project that will use them

From the dashboard

1. Sign in at configure.dev/login.
2. Name your agent. This becomes CONFIGURE_AGENT and the label on your sign-in button.
3. The keys screen shows sk_ and pk_. Copy both.
4. Under Sign-in button (OAuth client), enter the callback URL your app will receive the redirect on, then choose Create sign-in client.
5. Copy the client_id and the client_secret.

The callback field starts at http://localhost:3000/auth/configure/callback. Replace it with your real one if you already know it; you can add more later without changing client_id.

The client_secret is shown once. Configure stores a hash of it, so a lost secret is reissued, never recovered. Paste it into your server environment before you leave the screen.

That screen is the first thing a new account lands on. If you already have API keys, go to Sign-in (SSO) in the dashboard instead: it creates clients, adds callbacks to a client that already exists, and issues a new secret when yours is gone.

From the CLI

npx configure setup --users

Setup opens the same sign-in, then writes all five values to .env and registers http://localhost:3000/auth/configure/callback. Point it elsewhere with --redirect-uri http://localhost:5173/auth/configure/callback.

npx configure verify

Verify completes a real sign-in, exchanges the code with your secret, and reads a profile, so a rotated secret or a callback that differs by one character fails in your terminal instead of in a user's browser. Use --offline to check the values and the registration without signing in.

On a Python backend, pip install configure-ai and run configure-ai verify. Setup itself stays on npx, because it has to open a browser.

Callbacks

A callback URL is where Configure sends the user after they sign in. It has to match what your app sends, exactly. A trailing slash or a port is a different URL, and the mismatch surfaces at sign-in as an opaque redirect error rather than at registration.

Callbacks are additive. Local, each preview URL, and production are separate callbacks on one client, so CONFIGURE_OAUTH_CLIENT_ID never changes between environments.

Add a deployed one from your project:

npx configure add origin https://yourapp.com/auth/configure/callback

Or configure-ai add-origin https://yourapp.com/auth/configure/callback. The command opens the dashboard to confirm the exact client and URL, which is what makes it safe without a developer token: an sk_ key cannot modify an OAuth client, by design. Without the CLI, Add callback on the Sign-in (SSO) page does the same thing.

Then confirm what is registered matches what you deployed:

npx configure verify --offline --redirect-uri https://yourapp.com/auth/configure/callback

Four rules are enforced wherever you add a callback:

Rejected	Because
http://yourapp.com/cb	Callbacks use https. Only localhost and 127.0.0.1 may use http.
https://*.yourapp.com/cb	No wildcards. Add each origin you serve from.
https://yourapp.com/cb#section	No fragments.
https://user:pw@yourapp.com/cb	No embedded credentials.

Which credential does what

Credential	Job	Where it may appear
CONFIGURE_API_KEY (sk_)	Resolves the acting agent for server-side SDK calls	Server only
CONFIGURE_PUBLISHABLE_KEY (pk_)	Mounts hosted Configure UI	Browser
CONFIGURE_AGENT	Names your agent on buttons and permission screens	Browser
CONFIGURE_OAUTH_CLIENT_ID (oc_)	Identifies your app at the authorization step	Browser
CONFIGURE_OAUTH_CLIENT_SECRET (ocs_)	Authenticates the token exchange	Server only

The tokens your backend gets from the exchange, access_token and refresh_token, are also server-only. Nothing on the server-only side belongs in browser JavaScript, a client bundle, or a prompt.

Put them in your app

The two server-only values are read from the environment, never sent to the client:

// Server code only.
const CONFIGURE_API_KEY = process.env.CONFIGURE_API_KEY;             // sk_...
const CLIENT_SECRET = process.env.CONFIGURE_OAUTH_CLIENT_SECRET;     // ocs_...

The three browser-safe values are attributes on the hosted script's elements, so they ship in your client bundle by design. A build missing them renders a setup notice instead of a button, so bake them into your production build, not only your local .env:

<script src="https://configure.dev/js/configure.js"></script>

<configure-sso-button
  client-id="oc_..."
  redirect-uri="https://yourapp.com/auth/configure/callback"
  agent-name="Your Agent"
  scopes="profile.read profile.search profile.remember profile.commit">
</configure-sso-button>

redirect-uri here must be one of the callbacks you registered above, character for character.

Next: Choose your integration to see which of the five your path needs.