Getting started
API credentials
Each VenPays profile has one publishable key and one or more secret keys. Environment is on the profile, not on an extra key field.
Key types
| Type | Prefix | Use |
|---|---|---|
| Publishable | pk_test_… (Sandbox profile) or pk_live_… (Live profile) | Browser checkout SDK only. One active publishable key per profile. |
| Secret | sk_test_… or sk_live_… | Server X-API-KEY. Create as many as you need. Shown in full once. |
| Legacy | No prefix | Existing keys created before this model. Same privileges as a secret until you rotate. |
A Sandbox profile issues *_test_ keys. A Live profile exists only after Live access is approved and issues *_live_ keys.
Create and copy
- Open the dashboard in the correct mode (Test or Live).
- Select the target profile.
- Open API keys.
- Copy the publishable key anytime (it is safe to use in the browser).
- Create a secret key when you need a new server credential. Copy the plaintext immediately — secrets are masked after that.
Optional: restrict the publishable key to specific HTTPS origins (plus http://localhost for local work). An empty list means any origin can activate the widget.
Use a secret on the server
POST /merchant/initiate-payment
Host: merchant.venpays.com
X-API-KEY: sk_live_…
Content-Type: application/json
Sandbox example host: init-vpay.venlabs.link. Legacy unprefixed keys still work as X-API-KEY.
For embedded card checkout, your server also calls POST /v1/sdk/checkout with a secret, then the page calls VenPays.init with the publishable key and track_id. See JavaScript checkout SDK.
Rotate and revoke
- Rotate a secret or legacy key to mint a new
sk_…value. The old key stops working. If it was the profile default, the new key becomes the default. - Revoke a non-default secret when it should never be used again. Rows are kept; keys are not hard-deleted.
- You cannot revoke the profile’s default secret — rotate it instead.
- Rotating does not change the publishable key.
Existing unprefixed keys keep working until you rotate or revoke them.
Rules
| Do | Do not |
|---|---|
| Store secrets in your backend secrets manager | Put sk_… or legacy keys in frontend JS or mobile apps |
| Use the publishable key only in the checkout SDK | Send a publishable key as X-API-KEY |
| Rotate unused or exposed secrets | Share Live secrets in chat or tickets |
| Use each profile’s keys against that profile’s engine host | Treat a publishable key as able to charge or set an amount |