How the embed key works, and why it is not a secret

Every component you configure gets its own embed key. It is the only attribute the custom element takes:

<wpi-documents embed-key="your-embed-key"></wpi-documents>

What the key resolves to

The key is unique across the platform and identifies one configured instance — not a component type, and not your account. Resolving it gives the API everything it needs to serve that embed:

What the key determines	Why it matters to you
The component type	Which of the components this is, and therefore which entitlement is checked
The saved configuration	Layout, fields, filters, labels — everything the builder wrote
The owning account	Which subscription and which usage cycle this view counts against
The Microsoft 365 connection	Which tenant’s data it reads, and by which access mode
The allowed domains	Which sites may render this instance

Two embeds of the same component with different settings are two instances with two keys. That is the intended way to run, say, one Documents component showing a policy library and another showing a team’s working folder.

Why it is safe in your page source

The key is visible to anyone who reads the page. That is unavoidable for a client-side embed, and it is accounted for rather than tolerated:

• The key is an identifier, not a credential. It grants no access to your Microsoft 365 tenant, no ability to change the configuration, and no access to the dashboard. Configuration is read-only over this route.
• Server-side fields never reach the browser. The configuration is stripped before it is returned — credentials held on the instance, such as a proxy API key or a captcha secret, are removed on the server and are not part of the JSON your visitors receive.
• Reuse is bounded by the domain allowlist. Somebody who copies your key onto their own site gets a 403 unless their hostname is on your list. This is what stops a lifted key from spending your view allowance. It only works if the list is set correctly, which is why the default is to deny everything.

So: do not paste embed keys into a public forum thread if you can avoid it, but do not treat one leaking as a credential incident either. The action to take is to check the allowed-domains list, not to panic about the key.

What to do with a key you no longer want serving

Deactivating the instance in the dashboard is the switch. An inactive instance stops resolving and the embed returns 404 with Component is disabled, wherever in the world that markup is still pasted. Deleting the instance has the same effect on the embed.

Related

• Quick start: putting a web component on a page
• Restricting a component to your own domains
• Component error codes