Secrets are shown once, at creation. Payaider stores only a hash of each key, so no screen — including this one — can display a secret after the create call returns it. If a key is lost, create a new one and revoke the old one; there is no recovery path, by design. Only the prefix is shown here, which identifies the kind of key without identifying the key.
API keys
3 active · 1 revoked| Key | Type | Prefix | Mode | Last used | Status |
|---|---|---|---|---|---|
key_hQ47L4OfGqzXmRA narrowed key for one job — grant it only the scopes that job needs. | restricted | rk_test_····secret never shown again | test | 01 Nov 2026, 00:31 UTC8 d 7 h ago | active |
key_6KWLYEStf4JJVNFull server-side authority. Never ship it to a browser or a mobile app. | secret | sk_test_····secret never shown again | test | 01 Nov 2026, 00:48 UTC8 d 6 h ago | active |
key_uqDNf6LFmPTyXyRead-only and checkout-facing. Safe in a page the customer loads. | publishable | pk_test_····secret never shown again | test | 01 Nov 2026, 00:49 UTC8 d 6 h ago | active |
key_TCNhnurJOYkXdWFull server-side authority. Never ship it to a browser or a mobile app. | secret | sk_test_····secret never shown again | test | 29 Jul 2026, 00:51 UTC103 d 6 h ago | revoked04 Aug 2026, 00:51 UTC |
Rotating a key safely
Create the replacement first and deploy it, watch Last used on the old key go quiet, then revoke it. Revoking a key that something still holds returns 401 on the next request, and the request log will name the key prefix that failed.
Give every integration its own restricted key with only the scopes it needs. A fulfilment worker that reads payments does not need permission to move a wallet.