Skip to main content

​
API Keys

Authenticate all API requests with your secret API key in the Authorization header as a Bearer token:
Keys are secret credentials. Newly created keys are prefixed by mode — rsk_test_… or rsk_live_…. The demo dataset ships with the fixed test key sk_test_12345 for local exploration.
Never expose API keys in client-side code. Keys are secret and must only be used from your backend.

​
Test vs. live keys

Every key is either a test key (rsk_test_…) or a live key (rsk_live_…). A new account starts with a test key. A key’s mode must match the server’s payment configuration, reported at GET /version as gateway_mode:
If a key’s mode doesn’t match the server, the request is rejected with 401 key_mode_mismatch. This is deliberate: a test key can never run against a live-money server, and a live key won’t run on a non-live one. Build and test against a none/test instance with a test key — see Testing & Sandbox.

​
Generate a key

  1. Go to Settings → API Keys in your dashboard
  2. Click Create API Key and choose Test or Live
  3. Copy and store it securely — the full key is shown only once
Or via the API — the mode defaults to test:

​
Usage

Pass your API key in the Authorization header as a Bearer token:
Mutating requests also accept an Idempotency-Key header so retries never duplicate work — see Idempotency.

​
Key Scope

API keys are tenant-wide: every key grants the same access to everything in its tenant and mode (rsk_live_ / rsk_test_). There are no per-resource or read-only scopes, so contain blast radius by issuing one key per integration and revoking it on its own.

​
Security Best Practices

Environment Variables

Store keys in environment variables, not code

Rotate Regularly

Rotate keys periodically and after breaches

Use Test Keys in Dev

Develop with an rsk_test_ key against a none/test server

One Key per Integration

Keys are tenant-wide, so give each service its own key and revoke individually

​
Revoke a Key

If a key is compromised:
  1. Go to Settings → API Keys
  2. Click Revoke on the compromised key
  3. Generate a new key
  4. Update your applications
Revoking a key is immediate and permanent.