Prepare for Release

During development the SDK runs on an API key, and AI usage is billed to your account. In production, omit the API key so the SDK uses device auth — each player signs in with their own PlayKit account and pays for their own AI usage. This page covers the switch.

Remove the API Key

When no apiKey is present in the configuration, the SDK runs in player mode and presents the login flow automatically. The task is therefore to ensure the key is absent from production builds.

A bundler inlines whatever value an environment variable holds at build time. The key only reaches your bundle if it is defined in the build environment — so read it from a variable that exists only in local development, and never define that variable in CI or production:

const sdk = new PlayKitSDK({
  gameId: 'your-game-id',
  // Read from a local-only env var (e.g. a git-ignored .env.local).
  // Undefined in production builds, so the SDK uses device auth.
  apiKey: import.meta.env.VITE_PLAYKIT_API_KEY, // Vite
  // Next.js (browser):  process.env.NEXT_PUBLIC_PLAYKIT_API_KEY
  // Node / server:      process.env.PLAYKIT_API_KEY
});

1. Put the key in a git-ignored local file (for example .env.local); never commit it.
2. Do not define the variable in your CI or production build. Production builds then inline undefined, and the SDK uses device auth.
3. After building, search the output bundle for the key string to confirm it is absent (for example grep -r "<key-prefix>" dist/).

Production Settings

• Leave debug at its default (false) so verbose logging is disabled in production.
• Set baseURL only if you use a custom endpoint; otherwise leave it unset.
• Configure default models (defaultChatModel and related options) to match your game.

Branding

Configure the name, description, logo, and key art shown on the player sign-in and authorization screen. This is set on the PlayKit platform, not in the SDK — see Setting Up Branding.

Release Checklist

• Branding (name, logo, key art) is configured — see Setting Up Branding.
• No apiKey is present in the production build.
• The login flow appears for an unauthenticated player, and the red API key indicator is gone.
• AI calls are billed to the player's account.

Next Steps

• Authentication — full authentication reference
• Backend Services — server-side API key handling