API Keys

Key types

Type	Prefix	Use
Secret key	`sk_sandbox_...` / `sk_live_...`	Server-side — create payments, issue refunds, manage customers
Publishable key	`pk_sandbox_...` / `pk_live_...`	Client-side — initialize the widget, tokenize cards

Never expose a secret key in browser code, mobile apps, or public source repositories.

Key format

All keys follow the pattern:

{type}_{mode}_{32 alphanumeric characters}

Examples:

sk_sandbox_aB3cD4eF5gH6iJ7kL8mN9oP0qR1sT2uV
pk_live_wX3yZ4aB5cD6eF7gH8iJ9kL0mN1oP2qR

Viewing keys

Navigate to Developer → API keys, or go straight to dashboard.elasticpay.co/developers.

What you can see depends on the key:

Key	Visibility
Sandbox secret (`sk_sandbox_`)	Click Reveal to see and copy the full key at any time. It cannot move real money.
Publishable (`pk_sandbox_`, `pk_live_`)	Shown in full — publishable keys are designed to be public.
Live secret (`sk_live_`)	Never displayed. Only the last few characters are shown.

Getting more keys

Your account’s secret and publishable keys are created automatically with the account, one of each per mode. Additional keys, rotation, and revocation are handled by ElasticPay support for now — contact us if you need a key rotated or invalidated.

Primary keys

Each account has one primary secret key and one primary publishable key. The primary key is the default used by the dashboard’s built-in tools.

Revoked and expired keys

A revoked or expired key returns 401 authentication_error on all requests, and revocation cannot be undone. Revoked keys stay listed on the API keys screen so you can see what was invalidated and when.