Security

What is API key?

An API key is a credential used by a service to identify or authorize requests. Its actual permissions depend on the receiving system. Keys should be scoped, stored server-side, redacted from logs, rotated when needed, and never placed in public browser code.

An API key is not a substitute for per-user authorization or transaction policy. Systems should bind sensitive operations to the authenticated merchant, validate request bodies, and avoid granting broad account-wide permissions to keys used by a single integration.

Keep secrets in server-side environment or managed secret storage, rotate them after suspected exposure, and redact them from logs and support artifacts. Public identifiers and secret credentials should be documented separately.

Definitions are educational and general. Nothing here is financial, legal or tax advice, and regulatory descriptions summarise frameworks that change — check the current rules for your jurisdiction before relying on them.