Authentication Problems

Overview

Asiyst employs a dual-tier authentication architecture:

1. Public SDK Keys (pk_live_...): Used in client browsers, guarded by strict Origin / Referer validation.

1. Private API Keys (sk_live_...): Used on backend servers and in CI/CD, granting administrative access.

Error 403 Forbidden: Origin Mismatch

Cause

The browser's window.location.origin is not on the project's Allowed Domains whitelist.

Resolution

1. Open the Asiyst Dashboard > Project > Settings > Allowed Domains.

1. Add the exact origin from the browser address bar:

   - For local Vite / React: http://localhost:5173

   - For local Next.js: http://localhost:3000

   - For staging: https://staging.mycompany.com

   - For production: https://mycompany.com and https://www.mycompany.com

1. Do not include trailing slashes (e.g., use https://example.com, not https://example.com/).

Error 401 Unauthorized: Invalid Public Key

Cause

The public key is mistyped, belongs to a different project, or has been revoked.

Resolution

1. Confirm that your projectId and publicKey belong to the same project.

1. If using environment variables in Next.js, verify the prefix is NEXT_PUBLIC_:

      NEXT_PUBLIC_ASIYST_PROJECT_ID=proj_9f8a2b3c4d
   
      NEXT_PUBLIC_ASIYST_PUBLIC_KEY=pk_live_8e7d6c5b4a3f2e1d

1. Restart your development server after updating .env files.

User Session & Identify Issues

When identifying signed-in visitors with Asiyst.identify():

Asiyst.identify({
  userId: "usr_10293",
  email: "customer@example.com",
  name: "Jane Doe",
});

If user identity fails to reflect in conversation logs:

• Call Asiyst.identify() after Asiyst.init() has resolved.

• When the user logs out, always call Asiyst.logout() to reset the session token and clear cached credentials from localStorage.