Payracle uses two kinds of API keys, each with a live and test variant. Find both in your dashboard under Developer › API Keys.
Secret key
Pass it as a Bearer token on every request:
Never expose your secret key in client-side code, browser JavaScript, mobile app bundles, or public repositories. Rotate your keys immediately if you suspect they’ve been compromised.
Public key
The public key is deliberately restricted — it can only call POST /v1/checkout/initialize, and requires an extra header identifying your business:
This is what the JavaScript widget and mobile SDKs use, since it’s safe to ship in code a customer’s device can inspect — it can’t be used to list your transactions, create virtual accounts, or do anything beyond starting a single checkout.
Any other endpoint called with a public key returns:
Live vs test mode
Every key comes in a live and test pair. Payracle detects which mode you’re in automatically from which literal key you send — there’s no separate mode flag to set. Test mode calls never move real money:
- Virtual accounts and checkouts created with
sk_test_... / pk_test_... generate fake sandbox account numbers instead of calling SafeHaven/Paga/PalmPay.
- Sandbox checkouts can be marked paid via
POST /v1/checkout/sandbox/simulate — see Checkout & Dynamic Accounts.
IP whitelisting
Optionally restrict a secret key to specific IPs from Developer › API Keys. Requests from any other IP get: