Generate API keys and authenticate your requests.
Updated
Every request to the DashForDevs API requires an API key. There are two types of keys, each with different access levels and security requirements.
| Key Prefix | Type | Use In | Access Level |
|---|---|---|---|
pk_live_* | Public (Production) |
| Browser / Frontend |
| Read-only + cart + checkout |
pk_test_* | Public (Test) | Browser / Frontend | Same as live, test environment |
sk_live_* | Secret (Production) | Server ONLY | Full read/write access |
sk_test_* | Secret (Test) | Server ONLY | Full read/write, test environment |
Public keys are safe to use in client-side code. They can:
Public keys cannot:
Secret keys have full access to everything. Use them only in server-side code:
app/api/ in Next.js)NEXT_PUBLIC_ environment variable. If your key is compromised, rotate it immediately in Settings > API > Keys.
pk_test_* / sk_test_*) can still process real payments if your payment processor is configured with live credentials. Always ensure you are using your payment processor's test/sandbox keys (e.g., Stripe test keys, Authorize.net sandbox) during development. DashForDevs test keys only affect which DashForDevs environment you are hitting — they do not sandbox your payment processor.
Set up your keys in .env.local:
# Frontend (browser-safe)
NEXT_PUBLIC_DASH4DEVS_API_KEY=pk_live_your_key_here
# Backend (server-side only — NO NEXT_PUBLIC_ prefix)
DASH4DEVS_SECRET_KEY=sk_live_your_key_here
The NEXT_PUBLIC_ prefix tells Next.js to expose the variable to the browser. Never use this prefix for secret keys.
A typical setup uses two client instances:
// lib/dash.ts — public client for frontend
import { DashClient } from "dash4devs"
export const dash = new DashClient({
apiKey: process.env.NEXT_PUBLIC_DASH4DEVS_API_KEY,
})
// lib/dash-server.ts — secret client for API routes only
import { DashClient } from "dash4devs"
export const dashServer = new DashClient({
apiKey: process.env.DASH4DEVS_SECRET_KEY,
})
.env.local fileIf you suspect a key has been compromised:
There is no downtime — old and new keys work simultaneously until you delete the old one.
For additional security, you can restrict which domains can use your public key. Go to Settings > API > Allowed Origins and add your storefront domain (e.g., https://mystore.com). Requests from other domains will be rejected.
API requests are rate-limited per key using a sliding window counter:
| Key Type | Limit | Average |
|---|---|---|
Public keys (pk_*) | 120 requests/minute | ~2 req/sec |
Secret keys (sk_*) | 300 requests/minute | ~5 req/sec |
| No API key | 30 requests/minute | ~0.5 req/sec |
When you exceed the limit, the API returns 429 Too Many Requests with these headers:
Retry-After — seconds until the window resetsX-RateLimit-Limit — your limit per minuteX-RateLimit-Remaining — requests remaining in this windowX-RateLimit-Reset — Unix timestamp when the window resetsWebhooks, superadmin endpoints, and internal paths are exempt from rate limiting.