Payment API keys belong on the server in environment variables or a secrets store — not in code, not in the repository, not in messengers. A key can create payments on behalf of your store, so a leak is equivalent to access to money.
Where to keep them
- Environment variables on the server — the minimum acceptable option.
- A secrets store — once the infrastructure is more than one server.
- Never in the repository. Even a private repo is the wrong place: access is broader than it looks, and history keeps everything.
- Never in the browser. A secret key must not reach client-side code under any circumstances.
Who should have access
The application needs the keys, plus one or two responsible people — not the whole team. A developer, a manager and an ad contractor should not share the same secret.
Lock down the dashboard too: staff permissions there deserve the same scoping.
If you suspect a leak
- Issue a new key and switch the application to it.
- Revoke the old one.
- Review transactions for the period the key could have been exposed.
- Work out how it leaked — otherwise it happens again.
Related
Never collect card numbers yourself: that is a separate requirement, covered in what is PCI DSS. Verifying incoming notification signatures is covered in what is a webhook.
