Before writing any code, you need a PaymentsAPI account and your API keys. This step covers account creation, key types, and how to store keys securely from day one.
dashboard.paymentsapi.dev and click Create Account| Key type | Prefix | What it can do | Where to use |
|---|---|---|---|
| Secret key | sk_test_ / sk_live_ |
Full API access โ create transfers, manage accounts | Server-side only |
| Publishable key | pk_test_ / pk_live_ |
Tokenize account data only โ no transfer creation | Safe for client-side |
sk_live_ appears in version control, public logs, or client-side code โ rotate it immediately from the dashboard. Leaked live keys grant full transfer creation access.
sk_test_ key is visible immediately โ copy it nowwhsec_) is under Settings โ Webhooks โ you'll need it in Step 4Create a .env file in your project root and add it to .gitignore before your first commit.
sk_live_ key in AWS Secrets Manager, GCP Secret Manager, or a CI/CD secrets store โ never in environment files on a server.
sk_test_ key from dashboard.env file with API key.env to .gitignore