Three kinds of access
Your portal email and password open the workspace. An sk_live_ key authenticates a live merchant integration. An sk_test_ key authenticates the isolated simulator. Listener phone credentials identify a particular receiving device. A webhook signing secret verifies incoming gateway events; it is not an API bearer key.
Storage and distribution
Keep integration keys in your server secret store or protected deployment configuration. Do not embed them in browser JavaScript, mobile applications distributed to customers, support tickets or public repositories. Restrict production access to the people and services that operate your integration. Test keys also permit access to test records and need protection.
Rotation
Rotate test keys in the sandbox workspace after confirming your current password. For live merchant reissue, the existing API requires the current bearer key and a successful webhook challenge. It replaces both the live key and webhook secret. Coordinate the change with your integration because previous credentials stop working.
Lost or exposed keys
Revoke or rotate affected credentials promptly, update dependent systems, and review payment and device activity. Contact support if recovery requires an operator. Knowing a webhook URL or controlling a publicly echoed challenge is not enough to recover an existing live account. Never send your password or secret to support.
KEEP EXPLORING