Every SearchJet API request is authenticated with a key sent as a Bearer token. Each site has two kinds of key: a public search key and a private key. This guide explains the difference, how to find and store each one, and how to rotate them safely.

Key types

	Public search key	Private key
Can do	Search only: `GET /search`, plus the MCP server	Indexing, deleting, analytics, click tracking, AI generation
Safe in the browser?	Yes	No. Keep it on your server.
Format	A long token, with no prefix	32 letters and digits, with no prefix
Where to find it	Dashboard → Sites list, labelled "Public Key"	Dashboard → Sites → API Keys. Shown only once, when you generate it.

Both keys work with GET /client-info. With the private key it also returns your current usage figures; with the public key those figures are empty.

If you send the wrong key type, you get a 401. The private key on /search returns INVALID_API_KEY, and the public key on /index/* returns Invalid or expired token.

The public key is read-only, but anyone who has it can search everything in your index. Only index content you're happy for anyone to find.

Getting your keys

Sign up or sign in at app.searchjetengine.com.
Create a site for the content you want to search.
Copy the Public Key from the Sites list.
Open Sites → API Keys for that site and generate a key. Copy the private key straight into your secret store or .env file: it won't be shown again. If you lose it, generate a new one.

The number of API keys per site depends on your plan: Free 1, Pro 5, Growth 10, Enterprise unlimited. On paid plans, create a separate key for each environment or application, so that you can revoke one without affecting the others.

Using a key in requests

Send the key in the Authorization header, and add Accept: application/json. Keys in the query string aren't accepted.

curl -G "https://app.searchjetengine.com/api/v1/search" \
  -H "Authorization: Bearer $SEARCHJET_PUBLIC_KEY" \
  -H "Accept: application/json" \
  --data-urlencode "q=test"

In the browser, with the public key:

const res = await fetch('https://app.searchjetengine.com/api/v1/search?q=test', {
  headers: { Authorization: 'Bearer YOUR_PUBLIC_KEY', Accept: 'application/json' },
});
const { results } = await res.json();

On the server, with the private key loaded from the environment:

// Node.js
await fetch('https://app.searchjetengine.com/api/v1/index/bulk', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.SEARCHJET_PRIVATE_KEY}`,
    Accept: 'application/json',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ documents: [{ id: 'page-1', title: 'Hello', url: 'https://example.com/' }] }),
});

Click tracking (POST /analytics/click) and search analytics also need the private key. Have the browser send click events to an endpoint on your own server, and forward them from there.

Platform setup

WordPress and WooCommerce

Install the SearchJet Instant Search plugin and paste your API key into its settings. The plugin indexes your content automatically, including WooCommerce products.

Laravel

There's no Laravel package. Add the keys to .env:

SEARCHJET_PUBLIC_KEY=your_public_search_key
SEARCHJET_PRIVATE_KEY=your_32_character_private_key

'searchjet' => [
    'public_key' => env('SEARCHJET_PUBLIC_KEY'),
    'private_key' => env('SEARCHJET_PRIVATE_KEY'),
],

The dashboard suggests SEARCHJET_API_KEY as the variable name for the private key. Any name works, as long as your config reads the same one. The full walkthrough is in Step-by-Step Installation & Configuration.

Other languages

Use any HTTP client: read the key from an environment variable, and send it in the Authorization header. See the REST API Reference.

Storing keys safely

Add your environment files to .gitignore:

.env
.env.local
.env.production

The private key must never appear in:

Client-side JavaScript, HTML, or mobile app bundles
Version control
Log files or error reports
Tickets, screenshots, or public documentation

In production, use your host's secret or environment-variable settings. Treat the MCP URL (/api/v1/mcp/) like the public key: it carries the key in the path.

Rotating keys

Rotate keys on a regular schedule, when someone with access leaves, and immediately if a key might have leaked:

Generate a new private key under Sites → API Keys.
Deploy it to every application that used the old key.
Test indexing with the new key, and check your logs for 401 errors.
Revoke or delete the old key in the dashboard.

A revoked key can keep working for a short time after you revoke it, because key lookups are cached: up to 5 minutes for indexing and search, and up to an hour for click tracking and client-info. Plan for that window when you respond to a leak.

Troubleshooting

401 Unauthorized

The header is missing, or isn't in the form Bearer .
You're using the wrong key type for the endpoint (see above).
The key has extra spaces, quotes or a line break.
The environment variable isn't loaded. In Laravel, run php artisan config:clear.

Search works but indexing fails with 401: you're sending the public key to /index/*. Indexing needs the private key.

API Key Setup