Authentication & Security
Every request must go over HTTPS. Beyond that, the rule that matters is knowing which of your credentials are public and which are not.
Secret
Creates orders on your account. Never ship it to a browser or a mobile app, and never commit it. Regenerate it from Store Settings.
Public
Names the widget so we know whose it is. It is meant to be readable in page source; it grants nothing on its own, because a widget only answers on the domains you registered.
Secret
Signs the user_hash that proves a visitor is who your site says. Anyone holding it can impersonate any of your customers. Shown once, at the moment you generate it.