API key is a long, randomly generated string that an application sends with each API request so the provider can identify the calling account and decide what it may do. It identifies a project or account rather than a person, and it works as a shared secret: possession proves identity, with no built-in expiry or user consent, which is where OAuth takes over. The key travels in an HTTP header over HTTPS; a missing or revoked key returns HTTP 401. Payment providers issue publishable, secret, test, live and restricted keys. A leaked secret key lets attackers run card testing, refund to their own cards or redirect payouts, so keys belong in a secrets manager.
How does an API key work
The provider generates the key in its dashboard and stores a reference to it against the customer's account. The developer places the key in their server configuration, and every request carries it, usually in an HTTP header such as `Authorization: Bearer` followed by the key, or a custom header. When a request arrives, the provider looks up the key, checks that it is active, applies the permissions and rate limits attached to it, and processes the call. A missing or revoked key returns an HTTP 401 error.
Keys are only safe over HTTPS. Anyone who intercepts or copies the key can make the same calls as its owner until it is revoked.
API key authentication explained
API key authentication is a shared-secret model: possession of the string is proof of identity. It is simple to implement, which is why most payment and data APIs offer it, but it has no built-in expiry and no concept of a user granting consent. When a third party needs to act on behalf of a specific customer, APIs use OAuth instead, where the customer authorizes access and the third party receives a short-lived token. Machine-to-machine OAuth flows also rely on a client secret, which behaves much like an API key but is exchanged for tokens rather than sent on every call.
Types of API key in payment platforms
Payment providers typically issue several kinds. A publishable key can safely sit in a web page or mobile app and only creates tokens from card details. A secret key lives on the merchant's server and can create charges, issue refunds and trigger payouts. Test keys work only in the sandbox environment, while live keys move real money. Restricted keys limit access to specific endpoints, for example read-only access for a reporting tool.
What a leaked API key costs
Secret keys committed to public code repositories are one of the most common API security failures, and automated scanners pick them up within minutes. A leaked secret key for a payment account lets an attacker run card-testing attacks, issue refunds to their own cards, or redirect payouts. On a platform processing $500,000 a month, a single weekend of abuse can produce losses and chargebacks far larger than the fees earned.
Standard controls are storing keys in a secrets manager, rotating them on a schedule, limiting each key's permissions, and allowlisting server IP addresses. Providers that hold cardholder data treat key storage as part of their key management and PCI DSS controls, and due diligence on a payment business usually asks who inside the company can see live secret keys.