docs: teach site and collector key types for Capture and OTLP HTTP

src/content/docs/environment.mdx

@@ -106,8 +106,35 @@ For more information, see <Link.Page href="/environment#how-to-read-environment-
 You can find your site key in the [Arcjet dashboard](https://app.arcjet.com).
 Select your site, select "SDK configuration", then click to copy.
 
-Arcjet keys are secrets that are always prefixed with `ajkey_`.
-As this is a secret, do not commit it to source control or otherwise expose it.
+`ARCJET_KEY` for `protect()` and `guard()` is a site key. Do not use a
+collector key there.
+
+Arcjet issues two kinds of secret. Capture and OpenTelemetry Protocol
+(OTLP) HTTP accept either kind:
+
+| Kind | Prefix | Accepted by |
+| ---- | ------ | ----------- |
+| Site SDK key | `ajkey_` | `protect()`, `guard()`, Capture, and OTLP HTTP |
+| Project collector key | `aj_prj_key_` | Capture and OTLP HTTP |
+
+Collector keys are ingest-only. In production, Guard and Decide respond
+`404` to a collector key.
+
+OTLP export to Arcjet is HTTP only. Set this header on the exporter:
+
+```sh
+OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer SITE_OR_COLLECTOR_KEY"
+```
+
+Replace `SITE_OR_COLLECTOR_KEY` with a site key (`ajkey_...`) or a project
+collector key (`aj_prj_key_...`). Send the export to the Arcjet OTLP HTTP
+endpoint. gRPC OTLP is unsupported.
+
+Project collector keys are issued through the project and site APIs. They
+are not shown on the site dashboard.
+
+These keys are secrets. Do not commit them to source control or otherwise
+expose them.
 
 <a name="arcjet-log-level" />
 

src/content/docs/guards/capture.mdx

@@ -73,6 +73,18 @@ event is sent with source `"sdk"`.
 
 Do not put secrets or PII in `metadata`. It is stored as untrusted data.
 
+## Keys
+
+`capture()` uses the key configured on the client. Capture accepts a site
+key (`ajkey_...`) or a project collector key (`aj_prj_key_...`).
+
+Collector keys are ingest-only. Do not use one for `guard()` or
+`protect()`, and do not set it as `ARCJET_KEY`. In production, Guard and
+Decide respond `404` to a collector key.
+
+For more information about key types, see
+<Link.Page href="/environment#arcjet-key">Environment variables</Link.Page>.
+
 ## Delivery
 
 Capture is best-effort and never blocks or throws into application code:

src/content/docs/troubleshooting.mdx

@@ -151,12 +151,15 @@ security checks.
 ```
 
 This error means that the Arcjet key you are using is invalid. Each site has a
-unique key to identify it within Arcjet. You can find your key in the Arcjet
-dashboard by clicking your site name and then going to the SDK installation tab.
+unique site key to identify it within Arcjet. You can find your site key in the
+Arcjet dashboard by clicking your site name and then going to the SDK
+installation tab.
 
-Arcjet keys are always prefixed with `ajkey_`
+Site keys are prefixed with `ajkey_`. Project collector keys are prefixed
+with `aj_prj_key_` and are ingest-only. Do not use a collector key as
+`ARCJET_KEY` for `protect()` or `guard()`.
 
-You provide the Arcjet SDK with the key when instantiating the client. For
+You provide the Arcjet SDK with the site key when instantiating the client. For
 example in this case the key is defined in an environment variable called
 `ARCJET_KEY`:
 
@@ -200,6 +203,15 @@ aj = arcjet(
 </TabItem>
 </Tabs>
 
+### Collector key used for protect or guard
+
+A project collector key (`aj_prj_key_...`) is ingest-only. Capture and
+OTLP HTTP accept it. In production, Guard and Decide respond `404`.
+
+Use a site key (`ajkey_...`) for `ARCJET_KEY`, `protect()`, and `guard()`.
+For more information about key types, see
+<Link.Page href="/environment#arcjet-key">Environment variables</Link.Page>.
+
 ### [deadline_exceeded] the operation timed out
 
 ```text