# Client-safe browser, mobile, and desktop ingestion

Privileged Telemio server API keys must never be embedded in browser bundles, iOS applications, Android APK/AABs, React Native bundles, Electron/Tauri clients, or other distributed software.

Create a client-safe ingest key in Console > Manage > API keys. These keys are publishable identifiers with ingest-only permissions and server-enforced restrictions.

Bind a key to one or more of:

- exact or wildcard web origins
- a native application/bundle identifier
- a registered website
- allowed signals

Each client key also has request, byte, and daily-event budgets. Use separate keys per application when practical so an abusive or broken client cannot consume another application's budget.

For browser RUM add the client key to the RUM loader configuration. Native applications should send an application identifier with the request or export through a trusted Collector/gateway.