Merchant API credentials and environments

Protect credentials

Merchant API keys identify and authorise your integration. Generate or view them only through the authorised merchant account area, store secrets in server-side environment configuration and restrict access to people who maintain the payment integration. Never paste a secret into chat, a support screenshot or client-side code.

Sandbox and production

• Use sandbox while building and testing. No sandbox result should trigger real-world fulfilment.
• Use production only after verification, callback handling and failure paths have been tested.
• Send the environment header and credentials documented for the same environment; do not mix test and live keys.
• Use unique test references and keep sandbox records visibly separate from live reporting.

If a key is exposed

Generate a replacement through the authorised credential workflow and update your server configuration promptly. Review recent transaction records and contact integration support. Do not publish the compromised value in the support ticket.