API keys: creating, rotating, revoking

There are two kinds of credentials, managed from the Developers page:

• Transaction keys (API login ID + transaction key) — for the gateway transaction API
• Billing secret keys (sk_test_… / sk_live_…) — for the billing API: customers, products, subscriptions, invoices

Good hygiene

• Keys are shown once at creation — copy and store them somewhere safe
• Rotate any key that may have leaked: create a new one, update your integration, then revoke the old one
• Keep sandbox and live keys separate; the prefix tells you which is which

Only merchant owners can create or revoke keys. Revoking takes effect immediately.