API Keys

Manage sandbox and production keys, scope them to specific resources, and rotate without downtime.

Updated Jul 15, 2026API 2026-07-01 Edit on GitHub Report an issue

Overview

Every request is attributed to a single API key. Keys are environment-scoped (sandbox or live), can be permission-scoped, and cannot be viewed a second time after creation.

API keys

Create key

Production server

sk_live_••••••••••••4a2f

liveFull access3 minutes ago

Web checkout

sk_live_••••••••••••4a2f

livePublishableJust now

Analytics reader

sk_live_••••••••••••4a2f

liveRestricted: read2 days ago

Local dev

sk_test_••••••••••••b19c

sandboxFull access12 minutes ago

Illustrative preview — actual keys are managed in the dashboard.

Creating a key

1Open Developers → API Keys
Choose the environment (sandbox or live).
2Name the key
Use a name that describes the workload (e.g. `checkout-web`, `payroll-worker`).
3Pick a scope
Full access, publishable, or restricted with a granular permission set.
4Copy the secret
The full value is shown once and stored hashed on our side.

Scopes

Field	Type	Description
payments:read	restricted	List and retrieve payments.
payments:write	restricted	Create, capture, refund, cancel.
customers:*	restricted	All customer operations.
wallets:read	restricted	Read balances and ledger.
withdrawals:write	restricted	Initiate payouts.
*	full	Everything — reserve for trusted backends.

Rotate & revoke

Rotating issues a new secret with the same scope. The previous key stays valid for 24 hours to give clients time to redeploy. Revocation is immediate.

Usage & activity

Every key exposes request volume, error rate, and top endpoints for the last 30 days.
The audit log records key.created, key.rotated, key.revoked, key.used_from_new_ip.
Configure alerts to fire when a live key is used from a new IP for the first time.

Authentication

Environments