The two credentials
Your API key stays on your server. It can mint tokens, run turns, and read any of your conversations. It can bill credits. Do not ship it in a browser or a mobile app. A client token (c3_ct_…) is a short-lived pass for one browser session. It can only run turns and read the conversation it is bound to. The API key that minted it pays for its turns.