API keys

API keys are credentials that authenticate your requests to the PayMongo API. Every PayMongo account receives four keys upon signup: two for test mode (sandbox) and two for live mode (production). Keys are available immediately—even before your account is fully activated.

Key types

Key difference:

• Public keys (pk_*) create tokens and payment sources in client-side code. They do not expose sensitive data.
• Secret keys (sk_*) authenticate API requests and allow you to retrieve full transaction and account data. They must be kept private and used server-side only.

Where to find your API keys

1. Log in to the PayMongo dashboard
2. Navigate to Developers (or API Keys)
3. View your four keys (test and live, public and secret)

All keys are visible here after login and MFA verification.

How to authenticate API requests

PayMongo uses HTTP Basic Authentication. Your secret key acts as the username, with no password.

Example (cURL):

curl https://api.paymongo.com/v1/payment_intents \
  -u YOUR_SECRET_KEY:

Replace YOUR_SECRET_KEY with your actual secret key. The colon (:) at the end leaves the password field blank.

Equivalent header:

Authorization: Basic base64(YOUR_SECRET_KEY:)

In code (Node.js example):

const fetch = require('node-fetch');
const key = process.env.PAYMONGO_SECRET_KEY; // Use environment variables

const response = await fetch('https://api.paymongo.com/v1/payment_intents', {
  method: 'POST',
  headers: {
    Authorization: `Basic ${Buffer.from(`${key}:`).toString('base64')}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    // request body
  }),
});

Best practices

🔒

Security best practices — follow these always:

1. Never expose secret keys in client-side code. Secret keys grant full access to your account and all transaction data. If exposed in a public repository, a GitHub action, or client-side logs, your account is compromised.

2. Use environment variables. Store sk_* keys in .env files (development) or secure secret management (production—e.g., AWS Secrets Manager, GCP Secret Manager). Never hardcode keys in source code.

3. Use public keys in frontend code. pk_* keys are safe to embed in client-side code, mobile apps, and frontend repositories.

4. Always use test keys during development. Use pk_test_ and sk_test_ for all development, testing, and CI/CD pipelines. Never test against live keys—live keys process real transactions.

5. Rotate keys immediately if compromised. When a secret key is exposed (e.g., committed to a public repo, leaked in logs), regenerate it immediately from the dashboard. The old key is invalidated at once, and any integration using the old key will fail.

6. Use different keys for different environments. Use sk_test_ for dev/staging, and sk_live_ for production only. Use separate source control branches or secrets management to keep them isolated.

Generating, rotating, and revoking keys

Viewing your keys:

• Log in to the PayMongo dashboard
• Go to Developers
• Your four keys are displayed

Rotating (regenerating) a key

A compromised or expired key can be regenerated to invalidate the old one immediately.

1. Go to Developers in the dashboard
2. Find the key you want to rotate
3. Click Regenerate (or the refresh icon)
4. Confirm the action — you will be prompted for MFA verification (OTP)
5. The new key is displayed. Copy it immediately. The old key is now invalid.
6. Update all systems, servers, and integrations using the old key to use the new one before completing the rotation. If you don't, those integrations will break.

⚠️

Important: Regenerating a key immediately invalidates the old one. If your integrations still use the old key, they will fail. Update all services before rotating in production.

Revoking a key

PayMongo does not currently offer a "revoke without replace" option. To revoke a key, regenerate it. The regeneration process invalidates the old key and provides a new one.

Next steps

• Multi-Factor Authentication — Secure your dashboard access with MFA
• Security Logs — Monitor account activity and detect unauthorized access
• Account Setup — Create and activate your PayMongo account