Public Key (Apps & Extensions)

The Chatgram widget on a website reads the domain of the page to figure out which admin to notify. Native mobile apps and browser extensions don’t have a web domain that Chatgram can read automatically.

For those contexts, Chatgram uses a public key instead: a unique identifier tied to your verified website. Your developer passes the public key when initialising Chatgram in the app or extension, and Chatgram uses it to identify which admin should receive messages.

Think of it this way: on the web, “domain” is the identifier. On apps and extensions, “public key” is the identifier. Same purpose, different mechanism.

Public keys are generated per verified website. To find yours:

• From the Chatgram Telegram bot: navigate to your website’s settings, then to Development Keys. The public key is listed there. Tap to reveal, tap to copy.
• From the web admin panel: sign in at chatgram-admin.brandid.app, select your website, and look under Development Keys.

The public key looks like a long alphanumeric string. Copy the entire string.

The public key is safe to share with your team. It identifies your website but doesn’t grant any privileged access.

Common ways to share:

• Send it directly in your team’s Slack, Discord, or Telegram chat
• Add it as an environment variable in your CI/CD or deployment system (recommended for production apps)
• Include it in a config file your team already shares

Your developer then passes the public key when initialising the Chatgram package in your app or extension.

Yes. A single verified domain can power your website and your mobile app at the same time:

• On the website, Chatgram detects the domain automatically
• In the mobile app, the same site’s public key is supplied manually to the Chatgram SDK

Both sources produce tickets in the same queue, so all your customer messages, whether they came from your website or your mobile app, arrive in one place. You manage them all from one Telegram chat or one admin panel view.

Each website has two keys:

• Public key. Used to identify the site when sending messages from apps, extensions, or non-web contexts. Safe to ship in client-side code, mobile app bundles, extension manifests.
• Secret key. Used for privileged / development-side operations. Never share it with anyone outside your team, never commit it to public source control, never ship it to end users.

The distinction is roughly:

• Public key = “which website is this?”
• Secret key = “prove you’re allowed to configure this website”

If you suspect your secret key has leaked (accidentally committed to GitHub, shared publicly, or exposed in a build), rotate it immediately:

1. Open the Chatgram Telegram bot or web admin panel
2. Navigate to your website’s Development Keys
3. Rotate / regenerate the secret key
4. Update any place you use the old key (CI/CD, deploy scripts, environment variables)

Public key rotation is usually not needed since it’s designed to be shipped publicly. If you need to rotate it anyway (e.g. compliance requirement), the same flow applies, but you’ll also need to update every app and extension that uses it.