Get your keys
Copy the publishable key
Open API keys in Test mode. The publishable key is always shown in full, so you can copy it whenever you need it.
Create the secret key
Choose Create secret key. The complete key is shown once, so store it in your server’s secret manager straight away. Afterwards the dashboard shows only its last four characters.
Roll a secret key
Roll the secret key when it may have been exposed, or on a regular schedule.Choose when the current key stops working
In API keys, choose Roll key and pick Now, 1 hour, 24 hours, or 7 days. Pick Now only if the key has leaked: requests using it fail immediately.
Store the new key
The new key is shown once. Install it in every server that uses the old one and deploy.
Let the old key expire
Until the time you chose, both keys work, so your servers keep accepting payments while you deploy. The dashboard shows when the old key stops working.
Keep keys safe
- Never commit a key to source control.
- Never send a secret key to the browser, a mobile application, analytics, or logs.
- Do not put keys or client secrets in URLs.