How do I create and protect API keys?

Short answer

Create keys under Developers → API Keys in the correct console environment. Use publishable keys in supported clients and secret keys only on your backend. A secret key can read sensitive results, so treat it as a credential rather than a configuration label.

Choose the right key

Test and live prefixes identify Sandbox and Production. Publishable keys begin with pk_; secret keys begin with sk_. Keep one environment throughout the workflow, result and webhook path.

Creating a key requires the relevant permission. Secret keys are displayed once at creation; store them directly in your approved secret manager. They cannot be retrieved later from the key list. Publishable keys can be viewed again by authorised roles.

Restrict where keys are used

Publishable keys support browser-origin restrictions, and secret keys support IP-range restrictions. Test restrictions in Sandbox before applying them to a live integration. An incorrect backend egress address can stop result reads.

Browser-origin restrictions are a browser control, not a substitute for keeping a secret key on a trusted server. Do not place secrets in mobile apps, public repositories, screenshots, analytics or support messages.

Replace a key safely

For routine replacement, create a key of the same type and environment, apply the intended restrictions, deploy it and verify that the old key is no longer used before revoking it. Mobile clients can require time to move to a new publishable key.

If a secret may be compromised, revoke it promptly and follow your incident process. Revocation is immediate and cannot be undone. Review the audit log for key creation, restriction changes and revocation, without expecting it to contain the credential itself.

Related guides

• API key management
• Authentication