RealComposer
START FREE
Upstream APIsOfficial PostHog docs

PostHog Safe & Unsafe Practices

Direct Answer

The PostHog project API key (phc_) is public and can only ingest events. Personal API keys (phx_) can query all analytics data and manage the project, so they are server-only. Avoid sending personal data in event properties.

Credentials & Where They Belong

Client safe
Project API key (phc_)

Write-only event ingestion and feature flag evaluation.

Server only
Personal API key (phx_)

Reads insights, persons, and recordings across your projects.

Safe Practices

  • Scope personal keys to required projects and scopes

    Grant query:read for dashboards instead of full access.

  • Mask sensitive inputs in session replay

    Keep input masking on and block elements with personal data.

Unsafe Practices

  • Using a personal API key in a frontend dashboard

    Anyone can query every event and person in your project.

  • Capturing emails or names as event properties

    Analytics data is widely shared internally and is hard to purge later.

The RealComposer Pattern

Store POSTHOG_PERSONAL_KEY in the vault and expose a cached pipeline that returns aggregated metrics, never raw person records.

START BUILDING FREE

Frequently Asked Questions

Q:Is the PostHog project API key a secret?

No. It is designed for clients and can only send events. Personal API keys are the secrets.

PostHog Recipes

All PostHog recipes (3)
Mobile App (iOS & Android)PostHog
Security & Secret Vault

How to Call Posthog API Securely from Mobile App

To solve how to call posthog api securely from mobile app, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe
Frontend / WebPostHogClerk
Multi-API Aggregation

Merge Clerk User Profile with Posthog Feature Flags

To solve merge clerk user profile with posthog feature flags, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe

Related Concepts

PII Redaction

PII redaction is removing or masking personally identifiable information, such as names, email addresses, phone numbers, and payment details, from data before it is exposed, logged, or shared. In APIs, redaction ensures clients and logs receive only the personal data they truly need.

API Key

An API key is a unique secret string that identifies the application calling an API and authorizes its access. Providers use keys to authenticate requests, enforce quotas, and bill usage. Anyone holding the key can act as your application, so secret keys must stay on trusted servers.

Principle of Least Privilege

The principle of least privilege states that every user, service, and credential should have only the minimum permissions required to perform its task. For APIs, this means using restricted keys, narrow OAuth scopes, and client tokens limited to specific endpoints.