​
Secret keys

Every request carries your secret key as a bearer token:
Keys are shown once, when you create them on the dashboard’s Developers page. Keep them on your server, never in an app, a browser or a repository. Publishable keys (pk_) only open the checkout and are refused by the API.

​
Scopes

Give each system its own key with only the scopes it needs. Each endpoint in the API reference names the scope it requires (x-required-scope). A key without it gets 403 missing_scope.

​
Proof from your customer

Your key alone never moves escrowed money. Paying by transfer in your own UI, delivering, releasing, cancelling, disputes and payout accounts also need proof that the right customer approved the call:
  • a customer token in the KetaPay-Customer-Token header, which your customer gets by entering a one-time code (see Customer tokens); or
  • for a release_code escrow, the buyer’s 6-digit release code, entered by the seller.
KetaPay checks the customer is the right party: only the buyer releases, only the seller delivers.

​
If a key leaks

Roll it from the dashboard at once. KetaPay also revokes sk_live_ keys reported by GitHub secret scanning and emails you.