Project key and origin

Two values identify your installation: the account key (also called project key) and the origin saved in your account.

Account key

The key is generated when you create an account in Hubbo. It appears in the embed snippet as the key query parameter and is used by the embed to tell the API which account it belongs to. You can see it in Settings → Get Embed.

• The key is a public identifier, not a password. It is expected to be visible in your page source.
• It is a 24-character hex id. A mistyped or truncated key does not load Hubbo widgets; cookieOnly priming returns 404 for missing or malformed keys.
• It is not an API token. Hubbo has no public REST API, so the key cannot be used to read or change data on its own.
• Each Hubbo account has its own key. If you manage several sites with several accounts, use a different key on each.

How the key reaches the API

When the embed script is requested with a key, the API responds with an httpOnly cookie named hubbo_api_key (Secure, SameSite=None). The widget then talks to the GraphQL API with that cookie and also sends the key in a Hubbo-Project-Key request header. Read Cookies, CORS and credentials for the full picture.

Origin

When you create an account you provide the URL of the website that will host Hubbo. Enter the host including any subdomain, such as example.com; Hubbo stores it as an https:// origin, and only HTTPS addresses are allowed. You can change it later in Settings → General. The origin is used for:

• CORS: the API only allows credentialed browser requests from your account origin (and from hubbo.io), so the embed can only talk to Hubbo from the site you registered.
• Share links: the roadmap and status share panels show which origin the public content is intended for.
• Usage counting: visits from your real origin count as page views; signed-in admin editor previews do not.

Changing or checking the origin

1. Open app.hubbo.io and select the account in the account switcher.
2. Go to Settings → General and review the origin field.
3. Save, reload your website and check the Network tab for CORS errors.

See Troubleshooting if requests still fail.