> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pcnaid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage form keys

> Issue, rotate, edit, and review the public form keys that let storefront forms submit applications.

# Manage form keys

## What does this do for me?

A **public form key** lets your published storefront forms submit applications for your shop. You issue the key from **Settings** and paste it into your theme block. You can rotate it if it is compromised and restrict which origins may use it.

## 1. Open Settings

Open **Settings** in the Customer Gate navigation. The page shows your **Current embed configuration** and a **Form keys** table.

## 2. Issue a form key

In the form key section, select **Issue form key**. When the key is ready, the **Copy this form key now** card shows the value once. This value cannot be retrieved again, so copy it to your embed before selecting **I have saved this key**.

## 3. Understand the configuration

The **Current embed configuration** card shows:

* **Key status** — Active, or No active form key.
* **Submission URL** — the storefront submission endpoint.
* **Access URL** — the access-evaluation endpoint.
* **Storefront origin** — kept in sync from Shopify.
* **Additional headless origins** — for separate headless storefronts.

## 4. Rotate or edit a key

* Select **Rotate form key** to issue a new key that replaces the active one.
* In the **Form keys** table, select **Edit** on an active key to change its **Form key label** or **Additional headless origins (comma-separated)**. The store's own storefront origin is always included when a key restricts origins, so you never type a shop domain.

## 5. Restrict origins

The store's primary storefront origin is added from Shopify automatically. A key with an empty allowlist is permissive (any origin). To restrict, add the additional headless origins for separate storefronts; the Shopify-managed storefront origin is always included in a restricted key.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.