Authentication
API Keys Done Right
Authenticate payment requests with live and test API keys, path-aware enforcement, and credential rotation from the merchant portal.
Keys that match the environment you intend to call
PayoFlux issues separate live and test secret keys per merchant. The API layer enforces that test keys cannot call live paths and live keys cannot call test paths. Merchants can rotate credentials and manage related secrets such as encryption keys and webhook hashes from their account.
- Live secret keys
- Test secret keys
- Path-aware enforcement
- Credential rotation
- Related webhook/encryption secrets
How API authentication works
Generate credentials
Create or view API credentials in the merchant portal after your account is ready for integration.
Attach key to requests
Include the correct secret key when calling charge, status, hosted, or related payment endpoints.
Environment enforcement
If a key/path mismatch occurs, the request is rejected — protecting you from accidental live charges during testing.
Rotate when needed
Rotate keys after staffing changes, suspected exposure, or routine security policy intervals.
Why merchants use this
Safer defaults
Environment mismatch protection reduces costly operational mistakes.
Merchant-controlled secrets
Rotate credentials without waiting on opaque provider support processes.
Where this fits your business
Multi-stage deployments
Keep staging on test keys and production on live keys with clear separation.
Security incidents
Rotate keys quickly if a secret may have leaked from a repository or log.
Continue exploring
Simplify Payments with PayoFlux
One platform to accept, manage, and scale your payment operations.
