API keys

Each account has one secret key and one publishable key per environment, plus a signing secret per webhook endpoint. Only the test environment exists today, so every key you can get starts with a test prefix.

• Secret key: authenticates every API call from your server. Treat it like a password.
• Publishable key: safe to embed in a page, but reserved for future client-side use. No documented endpoint accepts it yet (see Authentication).
• Webhook signing secret: verifies that a webhook delivery came from KrokoPay. It is not an API key and cannot call the API (see Webhooks).

The prefix tells you what a key is before you use it. Code scanners and reviewers can match it, and your own code can check it at startup.

Open Developers → API keys in the dashboard. The secret key is masked until you reveal it; copy it straight into your environment instead of pasting it into chats or tickets. Signing secrets are shown on each endpoint under Developers → Webhooks.

Keep the secret key in an environment variable or in your platform's secret manager, and read it only in server code. Exclude local env files from version control.

# Server-side only. Never commit this file.KROKOPAY_SECRET_KEY=kp_test_sk_4f9a2c7e1b8d4a6f9c3e5d7b

Check the key once at startup so a missing or wrong key fails loudly in your logs, not as a 401 in front of a buyer:

// server/krokopay.ts: read the key once, on the server, and fail fast.const key = process.env.KROKOPAY_SECRET_KEY;​if (!key) {  throw new Error("KROKOPAY_SECRET_KEY is not set");}if (!/^kp_test_sk_[0-9a-f]{24}$/.test(key)) {  throw new Error("KROKOPAY_SECRET_KEY must be a test secret key (kp_test_sk_…)");}​export async function krokopay(path: string, init: RequestInit = {}) {  return fetch(`https://api.krokopay.app/v1${path}`, {    ...init,    headers: { ...init.headers, Authorization: `Bearer ${key}` },  });}

• Never put the secret key in front-end code, mobile apps, public repositories or URLs.
• Give each service that calls the API access to the variable, not a copy of the value in its config.
• Never paste the key into chats, tickets or screenshots. Share access to the secret manager instead.

Rolling a key creates a new one and revokes the old one immediately. There is no overlap period, so any request still using the old key gets 401 invalid_api_key from that moment on.

1. 1

   Step 1: Prepare the deploy

   Make sure you can update KROKOPAY_SECRET_KEY and restart your server in one go.

2. 2

   Step 2: Roll the key

   In Developers → API keys, choose roll on the secret key and copy the new value.

3. 3

   Step 3: Update and restart

   Set the new value in every environment that uses it and restart, then watch your logs for 401 responses.

1. Roll the secret key right away. Do not wait to find out how it leaked.
2. Deploy the new key everywhere it is used.
3. Review recent requests in Developers → Logs and your charges for anything you did not create.
4. Remove the old value from wherever it was exposed, including commit history and shared documents.

• The secret key is read from an environment variable on the server only.
• Env files are listed in .gitignore.
• Your code checks the kp_test_sk_ prefix at startup.
• You know how to roll the key and redeploy in one step.
• Logs never contain the full key.