What is an API key and how to keep it secure

An API key is a long random string that your server sends with each request, usually in an Authorization header. The service uses it to know which account the request belongs to and what it is allowed to do. For a payment gateway, the API key lets your backend create payments, read their status and, depending on permissions, send payouts.

Because the key acts on behalf of your account, it is as sensitive as a password. Anyone who has it can make requests as you. It belongs only on your server: in environment variables or a secrets manager, never in frontend JavaScript, mobile app bundles, public repositories or support chats.

Good practice is to use separate keys for test and production environments, separate keys for different services or team members where possible, and to rotate keys periodically and immediately after any suspected leak. Sensitive operations, such as payouts, should require more than just the API key, for example a second factor or confirmation in the dashboard.

Typical mistakes: committing a .env file with the key to Git, calling the payment API directly from the browser, logging full request headers, using the production key in local development, and confusing the API key with the webhook signing secret. These are different secrets with different purposes.

In Moonvex, API keys and webhook settings are created in the dashboard under Integration, webhooks can be checked with a test event, and payouts additionally require 2FA confirmation.

Keeping API keys safe

• store keys in environment variables or a secrets manager
• never expose them in frontend code or mobile apps
• use separate keys for test and production
• rotate keys after any suspected leak
• add the .env file to .gitignore