Two keys, two jobs
pulz keeps two secrets for you, and they are not interchangeable. The trigger token is the middle of every trigger URL, as in https://pulz.bio/t/YOUR-TOKEN/panic. The overlay key is the &k= on the end of a scene's browser source URL, as in https://pulz.bio/you/o?scene=2&k=YOUR-KEY.
Both are created the first time you need one, both belong to your account only, and both are readable only from your own signed-in dashboard.
What the trigger token unlocks
The token is the credential for the Remote Trigger API. Anyone who has it can run any action on the action list against your account: switch your scenes, drop your privacy screen, fire a test alert, start a timer, move a counter.
That is also the whole of it. None of those actions reads your data, spends money, posts anywhere or reaches another account, and a token that does not exist returns a 404 rather than an error that confirms real ones exist. The worst case is someone messing with what is on your screen, which is bad on stream and recoverable in a few seconds.
What the overlay key unlocks
- It names the realtime channel your open browser sources listen on, which is how a privacy screen, a timer or a test alert lands immediately instead of on the slow 30-second poll.
- It is the one thing that hands a browser source your tip provider tokens, so Streamlabs and StreamElements tips go straight from your provider to your own screen.
- It lets a source submit giveaway entries back to your account.
A browser source only ever listens on that channel, and your dashboard never sends on it - the pulz server does. So someone who reads your overlay key off a screenshot can watch a scene change, not cause one. What they can do is ask for the tip provider tokens it unlocks, which is the real reason the key belongs in OBS and nowhere else.
Why one action URL is fine to hand a mod
An action URL is a link. Pressing it does that one thing, it never opens your dashboard, and the person pressing it does not sign in to anything. That is why the mod recipe says to send one action's URL and not the base one from the Your trigger key card, which is the token with nothing attached.
Rotating your trigger token
Rotating replaces the token with a new one. It is the whole safety story for a secret that lives in a URL: one button, and every link you have ever copied stops working.
- Open your dashboard and pick Automations in the sidebar.
- Press Rotate at the top of the Your trigger key card.
- Read the confirmation, then press Rotate it.There is no undo, and no grace period on the old token.
- Paste the new URLs back into your Stream Deck, your shortcuts, your bot and anything you gave out.
Rotating the trigger token does not touch your overlay key, so your OBS sources keep working and nothing on stream changes while you do it.
If your overlay key gets out
The overlay key rides in the source URL, so it is exposed by the things that show a URL: a screenshot of OBS, a browser address bar on a second monitor, a shared scene collection. Keep that URL out of shot the way you would a stream key.
The Rotate button on the Automations page replaces the trigger token only. There is no button for the overlay key yet, so if one has been on screen, mail [email protected].
FAQ
Someone saw my trigger URL on stream. What do I do?
Rotate it. Automations, then Rotate, then Rotate it. Every copy of the old token stops working immediately, including the ones on other people's phones, and then you re-paste the new URLs.
Does rotating break my OBS sources?
No. The Rotate button on Automations changes the trigger token; your browser source URLs carry the overlay key, which is separate and stays as it is.
Can someone with my overlay key take over my overlay?
No. Sources only listen on that channel, and the dashboard does not send on it, so a copied key cannot fire anything. The exposure is that the key can fetch your Streamlabs and StreamElements tokens.
Are my keys on my public page anywhere?
No. Neither key is readable by anyone else through the site. The overlay key reaches a browser source only because you put it in that source's URL yourself.