[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"questions:item:en:how-to-store-api-keys":3},{"id":4,"title":5,"answer":6,"body":7,"category":102,"description":103,"extension":104,"meta":105,"modifiedAt":106,"navigation":107,"pairId":108,"path":109,"publishedAt":110,"question":111,"relatedPath":112,"seo":113,"seoTitle":114,"sitemap":115,"slug":116,"stem":117,"translationSlug":118,"__hash__":119},"questions_en\u002Fen\u002Fquestions\u002Fhow-to-store-api-keys.md","How To Store Api Keys","Payment API keys belong on the server in environment variables or a secrets store — not in code, not in the repository, not in messengers. A key can create payments on behalf of your store, so a leak is equivalent to access to money.",{"type":8,"value":9,"toc":94},"minimark",[10,13,18,47,51,54,57,61,76,80],[11,12,6],"p",{},[14,15,17],"h2",{"id":16},"where-to-keep-them","Where to keep them",[19,20,21,29,35,41],"ul",{},[22,23,24,28],"li",{},[25,26,27],"strong",{},"Environment variables"," on the server — the minimum acceptable option.",[22,30,31,34],{},[25,32,33],{},"A secrets store"," — once the infrastructure is more than one server.",[22,36,37,40],{},[25,38,39],{},"Never in the repository."," Even a private repo is the wrong place: access is broader than it looks, and history keeps everything.",[22,42,43,46],{},[25,44,45],{},"Never in the browser."," A secret key must not reach client-side code under any circumstances.",[14,48,50],{"id":49},"who-should-have-access","Who should have access",[11,52,53],{},"The application needs the keys, plus one or two responsible people — not the whole team. A developer, a manager and an ad contractor should not share the same secret.",[11,55,56],{},"Lock down the dashboard too: staff permissions there deserve the same scoping.",[14,58,60],{"id":59},"if-you-suspect-a-leak","If you suspect a leak",[62,63,64,67,70,73],"ol",{},[22,65,66],{},"Issue a new key and switch the application to it.",[22,68,69],{},"Revoke the old one.",[22,71,72],{},"Review transactions for the period the key could have been exposed.",[22,74,75],{},"Work out how it leaked — otherwise it happens again.",[14,77,79],{"id":78},"related","Related",[11,81,82,83,88,89,93],{},"Never collect card numbers yourself: that is a separate requirement, covered in ",[84,85,87],"a",{"href":86},"\u002Fen\u002Fquestions\u002Fwhat-is-pci-dss","what is PCI DSS",". Verifying incoming notification signatures is covered in ",[84,90,92],{"href":91},"\u002Fen\u002Fquestions\u002Fwhat-is-a-webhook","what is a webhook",".",{"title":95,"searchDepth":96,"depth":96,"links":97},"",2,[98,99,100,101],{"id":16,"depth":96,"text":17},{"id":49,"depth":96,"text":50},{"id":59,"depth":96,"text":60},{"id":78,"depth":96,"text":79},"security","Payment API keys must not live in code or travel through messengers. Where to keep them, how to limit access and what to do after a leak.","md",{},null,true,"question-21","\u002Fen\u002Fquestions\u002Fhow-to-store-api-keys","2026-08-12","How do you store payment API keys safely?","\u002Fpayment-api",{"description":103},"How to store payment API keys safely",{"loc":109},"how-to-store-api-keys","en\u002Fquestions\u002Fhow-to-store-api-keys","kak-hranit-api-klyuchi","qaPdomPxbQPhlbPKqTCHbSnHVP2dm5mMoLoZdIaAs9E"]