API keys
Understand your key types and how to rotate them.
Find your keys in the dashboard under Settings > API Keys & Webhooks. Each environment has its own pair.
| Key | Prefix | Where to use it |
|---|---|---|
| Test secret key | sk_test_ | Your server, against the sandbox |
| Live secret key | sk_live_ | Your server, against production |
| Test public key | pk_test_ | Checkout in the browser or a mobile app |
| Live public key | pk_live_ | Checkout in the browser or a mobile app |
Only secret keys work on the Business API. Public keys are for the Checkout SDK.
Rotate a key
Rotate your keys regularly, and immediately if one may have been exposed.
Generate a new key in Settings > API Keys & Webhooks.
Update the key in your secret manager and deploy.
Call GET /whoami from production to confirm the new key works.
Good practice
- Keep separate keys for each environment, and never share a key across them.
- Restrict live keys to your servers' fixed outbound IP addresses.
- Mask keys in logs and error reports.