Keys and secrets
Each app has three credentials. Keep them in environment variables, with these names:
THUNDERCLAP_APP_ID=app_...THUNDERCLAP_KEY=pk_...THUNDERCLAP_SECRET=sk_...| Variable | What it is | Where it goes |
|---|---|---|
THUNDERCLAP_APP_ID | Identifies the app | Your server |
THUNDERCLAP_KEY | Public key, for clients to connect | Your frontend (with your bundler's prefix) |
THUNDERCLAP_SECRET | Signs tokens and authenticates publishes | Your server only, never a browser |
THUNDERCLAP_URL | Optional: a custom domain | Both, only if you use one |
Environments
Use one app per environment, for example staging and production. Each has its own credentials and channels, so test traffic never reaches real users.
Secrets are shown once
The dashboard shows a secret only when it's created, and stores it encrypted. If you lose it, create a new one and revoke the old one.
Rotate without downtime
Create a second secret
In the dashboard, under Apps & keys, choose New secret. An app has at most two active secrets, and both work.
Deploy it
Update THUNDERCLAP_SECRET on your backend and deploy.
Revoke the old one
Revoke the previous secret. It stops working within about a minute.
Webhooks are signed with every active secret, so they verify throughout the rotation.