Every project has one project key and three secrets. Your server sends the project key plus one secret with each API call.
What each one is for
- Project key (starts with pk_): identifies the project. Not secret on its own.
- Live secret (sk_live_): real payments. Works once the project is approved.
- Test secret (sk_test_): test mode. Works right away, also while the project is in review.
- Webhook signing secret (whsec_): checks that webhooks really come from us, see Set up webhooks and verify signatures.
Secrets are shown once
We store secrets in a form we cannot read back, so the project page shows a secret only right after it is made. Keep them in your server's configuration, never in front-end code or a public repository.
Lost or leaked a secret?
Open the project and make a new one next to the secret you need. The old secret stops working at once, so update your server straight after. A new webhook signing secret also needs updating wherever you check signatures.
Lock the API to your servers
Add your server addresses to API IP allow-list in the project settings. Calls from anywhere else are refused. Leave it empty to allow any address.
The project page also shows how many API calls the project made in the last 24 hours. Full details are in the API reference.