---
id: help.security.api-keys
title: "Keep API keys safe"
canonical: https://docs.secureprocessing.app/help/security/keep-api-keys-safe
description: "A secret key is shown once, when it is made, and acts for your whole business. Keep it in your server’s settings, never in a website or an app, and roll or revoke it under  if it may have leaked."
last_verified: 2026-11-02
---

# Keep API keys safe

A secret key is shown once, when it is made, and acts for your whole business. Keep it in your server’s settings, never in a website or an app, and roll or revoke it under **Developers → API keys** if it may have leaked.

Who can: Owner, Administrator, Developer can make a live key in [Developers → API keys](https://dashboard.secureprocessing.app/developers/api-keys).

## The rules

- **It is shown once.** Copy it when it appears, under "Your new key — copy it now", straight into your server’s settings. If you lose it, make a new one.
- **It acts for your whole business.** Keys beginning sk_live\_ move real money, so treat one like a password.
- **Keep it on your server.** Never put a secret key in a website’s code, a phone app, an email or a chat.
- **Give each server its own key, with a name,** so you can tell them apart and turn one off.

## Roll a key

On the key’s page, press **Roll**. You get a replacement, and the old key keeps working for 24 hours, so you have time to put the new one in place without anything stopping.

## Revoke a key

If a key has leaked, press **Revoke** instead. It stops working straight away, and any request using it fails. Then make a new one.

**Last used** on the list tells you whether a key is still in use before you revoke it.

## Who can

Your owner, administrators and developers can make keys. A developer can make test keys, and can’t create or roll a live key, because rolling makes a new one. They can still revoke a live key. Making a live key may ask for a fresh code from your authenticator app.

For developers: [API keys](https://docs.secureprocessing.app/api-keys.md)

## Related

- [Give a developer access](https://docs.secureprocessing.app/help/account/give-a-developer-access.md)
- [Review your security history](https://docs.secureprocessing.app/help/security/review-your-security-history.md)
- [Report a security problem](https://docs.secureprocessing.app/help/security/report-a-security-problem.md)

Still stuck? Write to [admin@secureprocessing.app](mailto:admin@secureprocessing.app) with the key’s name, never the key itself.