Keep API keys safe
Short answer
A secret key is shown once, when it is made, and acts for your whole business. Keep it in your server’s settings, never in a website or an app, and roll or revoke it under Developers → API keys if it may have leaked.In this article
The rules
- It is shown once. Copy it when it appears, under "Your new key — copy it now", straight into your server’s settings. If you lose it, make a new one.
- It acts for your whole business. Keys beginning sk_live_ move real money, so treat one like a password.
- Keep it on your server. Never put a secret key in a website’s code, a phone app, an email or a chat.
- Give each server its own key, with a name, so you can tell them apart and turn one off.
Roll a key
On the key’s page, press Roll. You get a replacement, and the old key keeps working for 24 hours, so you have time to put the new one in place without anything stopping.
Revoke a key
If a key has leaked, press Revoke instead. It stops working straight away, and any request using it fails. Then make a new one.
Last used on the list tells you whether a key is still in use before you revoke it.
Who can
Your owner, administrators and developers can make keys. A developer can make test keys, and can’t create or roll a live key, because rolling makes a new one. They can still revoke a live key. Making a live key may ask for a fresh code from your authenticator app.