Skip to content
Grona Developers

Keys and environments

Grona uses a handful of keys and identifiers across the website script, the mobile SDKs and the Public API. Most of them are public by design and are meant to ship in a page or an app. Two are secrets. Use this page to check what each one is before you put it in code, a config file or a support ticket.

Every key and identifier

Section titled “Every key and identifier”
Key or identifier What it is Where it comes from Safe in a browser or app? Rotate or revoke
Workspace id (web) The id after /workspaces/ in your script URLs on cdn.grona.ai The install snippet in the Grona dashboard Yes. It is in every page that loads the script. Not a secret, so there is nothing to rotate.
Workspace key (mobile) The public identifier you pass to GronaOptions.Builder, such as acme-market Grona, when your workspace is set up for apps Yes. It ships inside your app. Not a secret, so there is nothing to rotate.
Configuration public keys A key id, such as acme-market-2026-10, and a P-256 public key as base64 DER SubjectPublicKeyInfo, passed with configKey. The SDK uses them to check the signature on the configuration and on preview pins. Grona Yes. They are public keys; the matching private key stays with Grona. Pass the current key and the next one, so a configuration signed with either is accepted. See Rotate signing keys.
Grant public keys A key id and a P-256 public key in the same format, passed with grantKey. The SDK and your order backend use them to check grant signatures. Grona Yes. They are public keys. As for configuration keys: ship current and next. See Rotate signing keys.
Secret API key grona_sk_<keyId>_<secret>, sent to the Public API as Authorization: Bearer (or X-API-Key). It can create, change and delete campaigns in your workspace. Grona issues it to you No. Server side only. Never put it in a browser, an app, a repository or a support email. Contact support@grona.ai. There is no self-serve key management.
Preview pairing code (mobile) The code in a mobile preview link. The SDK exchanges it for a preview pin bound to the device that opened the link. Grona Treat it as a secret. Anyone who opens the link gets the pin on their own device. Codes are single use and expire within minutes. A pin lasts at most 24 hours. Open <your app scheme>://grona-preview?clear=1 to remove pins from a device. See Preview links (Android).
Editor link The editUrl the Public API returns for a variation. It opens the visual editor. The Public API No. It is a secret and expires after 15 minutes. Open it straight away; do not store, log or forward it. Request a fresh link when it expires. See Visual editor links.
Preview link (web) Your page URL with ?gronaPreview= and a variation id. It shows the variation and records nothing. The Grona dashboard, or previewUrl in the Public API It is not a credential, but it is not private either: it does not expire, and anyone with the link can see the variation. It cannot be revoked or expired.

Grona stores secret API keys as a one-way hash, so it cannot show you a key again. Keep your copy in a secrets manager and read it from the environment, as the Public API quickstart does with GRONA_SECRET_KEY.

Environments

Section titled “Environments”

Grona has one environment: production. There is no sandbox, no test workspace and no test key. Every API call and every published campaign acts on your live workspace.

To try changes without affecting visitors and shoppers:

  • Website. Build the variation, then open its preview link. Preview applies the variation on your real page without recording anything, and it works while the campaign is paused.
  • Public API. New campaigns start paused, so you can create one, edit it and preview it before you set it live. Deleting a campaign is permanent.
  • Apps. Use a preview link to pin one variant to your own device. Preview events are flagged and left out of analysis. In debug builds, the debug view shows the configuration, campaigns and arms on the device and can pin a variant locally.

Next steps

Section titled “Next steps”