API Key Security
Best practices for storing and rotating API keys.
Updated
On this page
Key Types
| Prefix | Access Level | Safe for Browser? |
|---|---|---|
pk_* | Read-only storefront | Yes |
sk_* | Full admin access | No — server only |
Best Practices
- Store keys in environment variables, never in source code
- Use
NEXT_PUBLIC_prefix only for the public key - Never commit
.env.localto version control - Rotate keys immediately if exposed
- Use separate keys for development and production
The SDK prevents
sk_* keys in browser environments. If you accidentally use a secret key client-side, the SDK will throw an error.
Rotating Keys
- Go to Settings → API Keys in the dashboard
- Generate a new key
- Update your environment variables
- Revoke the old key
Next Steps
- CORS & Allowed Origins — Domain restrictions
- API Keys & Authentication — Getting keys