How to keep your payment API keys secure

Your secret API key can move money. Treat it like the password to your bank. Here's how to keep it safe.

Public vs secret keys

• Public key — safe in client-side code; can't do sensitive actions.
• Secret key — server-only. Never put it in your frontend, a mobile app, or a public repo.

The rules

1. Server-side only. Initialize payments and charge cards from your backend, never the browser.
2. Environment variables. Load keys from env, not hard-coded strings.
3. Never commit keys. Add .env to .gitignore. Scan your git history.
4. Rotate on suspicion. If a key might have leaked, rotate it — the old one stops working instantly.
5. Least privilege. For platform integrations, use scoped access tokens that grant only what's needed.

Test vs live

Use test keys in development and CI. Reserve live keys for production, held by as few people as possible.

If a key leaks

Rotate it immediately from your dashboard, then review recent activity for anything unexpected. Because a leaked secret can create charges, speed matters.

Bonus: verify webhooks too

A secret key isn't the only sensitive credential — your webhook signing secret matters just as much. Store it the same way and use it to verify every inbound event.

Security here is mostly discipline, not cleverness. Keep secrets server-side, out of version control, and rotate without hesitation.