Public and secret keys

Every API key is a pair: a public half and a secret half.

Send either in the X-API-Key header:

curl https://papi.dashfordevs.com/api/storefront/products -H "X-API-Key: pk_live_…"

#Test and live keys

• Test keys skip the origin check, so they work from localhost, curl and CI. Use them while building.
• Live keys enforce HTTPS and your allowed origins for the public half.

#How papi checks a request

In this order, each one stopping the request with a clear error:

1. Is there a key, and does it look like one? (401 api_key_required, 401 invalid_api_key_format)
2. Does it exist? (401 invalid_api_key)
3. Is it active? (403 api_key_inactive)
4. Is the organization active? (403 organization_shutdown)
5. For a live public key: is the origin allowed and the connection HTTPS? (403 origin_not_allowed)
6. For admin routes: is it a secret key? (403 secret_key_required)
7. Under the rate limit? (429)

Then papi forwards the request with a short-lived signed identity. The services behind it never see your key, and check the identity again themselves.

#Keys in the SDK

The SDK protects you from the most common mistake: it throws if it is created with an sk_ key in a browser, or if any NEXT_PUBLIC_* variable holds a secret key (it names the variable, never the value). Use assertServerOnlyKey from dash4devs/security in your server-only module.