Skip to main content

Securing API keys

NOTE

Keep your API keys private and secure, and don't share them with anyone you don't trust. Anyone with your API key can call all Safepay Nordic APIs on your behalf.

Keep in mind when securing keys:

  • Don't leave API keys in publicly accessible places such as GitHub or client-side code. Only use them from your backend.
  • If you suspect that unauthorized people know a key, replace it right away (see Rotating API keys).
  • Rotate your API keys periodically.

Rotating API keys​

Your marketplace has a primary API key and can add a secondary API key in the Safepay Nordic portal. Both keys work at the same time, so you can replace a key without downtime:

  1. Add a secondary API key in the portal.
  2. Update your integration to use the secondary key and deploy it.
  3. When nothing uses the old key anymore, remove or replace it in the portal.