API Keys Setup
API keys let your app connect to ClapPay. Here's how to find them, keep them safe, and what to do if they get exposed.
What Are API Keys?
API keys are like passwords that let your website or app talk to ClapPay. Every time your app makes a request (like creating a payment), it needs to include an API key to prove who it is.
You get two types of keys, and each comes in a test version and a live version:
Types of API Keys
Publishable Key
pk_test_... or pk_live_...- Safe to use in frontend code
- Can create tokens and payment forms
- Cannot make charges or access data
Secret Key
sk_test_... or sk_live_...- Never use in frontend code
- Can create payments, refunds, payouts
- Full access to your account data
Where to Find Your Keys
- Log in to your ClapPay Dashboard
- Click Settings in the left menu
- Go to API Keys
- You'll see your test keys by default. Click the toggle to switch between test and live keys.
Note: You'll only see live keys after completing your business verification. Until then, use test keys to build your integration.
Test Keys vs Live Keys
| Feature | Test Keys | Live Keys |
|---|---|---|
| Prefix | _test_ | _live_ |
| Real money? | No - fake payments only | Yes - real charges |
| Test cards work? | Yes | No - only real cards |
| Verification needed? | No | Yes - must verify business |
Keeping Your Keys Safe
Your secret key is like a password to your bank account. If someone gets it, they can make refunds, access customer data, or transfer money. Here's how to keep it safe:
Do:
- Store keys in environment variables
- Keep secret keys on your server only
- Use different keys for test and production
- Rotate (change) keys regularly
- Limit who on your team can see keys
Don't:
- Put secret keys in JavaScript that runs in browsers
- Commit keys to Git or other version control
- Send keys in emails or chat messages
- Use the same key for multiple projects
- Share keys with people outside your team
Example: Store keys in environment variables
# .env file (never commit this!)
CLAPPAY_SECRET_KEY=sk_test_abc123...
CLAPPAY_PUBLISHABLE_KEY=pk_test_xyz789...
# In your code
const clappay = require('@clappay/sdk')(
process.env.CLAPPAY_SECRET_KEY
);What If My Key Gets Exposed?
If you accidentally share your secret key publicly (like in a GitHub repo), act fast:
- Roll the key immediately - Go to API Keys in your Dashboard and click "Roll Key". This creates a new key and disables the old one.
- Update your code - Replace the old key with the new one everywhere you use it.
- Check for suspicious activity - Look at your recent transactions and API logs for anything unusual.
- Contact support - If you see any unauthorized activity, let us know right away.
Good news: ClapPay monitors public code repositories and will alert you if we find your keys exposed publicly.
Restricted API Keys
For extra security, you can create restricted keys that can only do certain things. For example, you might create a key that can only:
- Read payment data but not create new payments
- Create refunds but not access customer data
- Work with subscriptions only
To create a restricted key, go to Settings → API Keys → Create Restricted Key.