Secrets are shown once, at creation. Payaider stores only a hash of each key, so no screen — including this one — can display a secret after the create call returns it. If a key is lost, create a new one and revoke the old one; there is no recovery path, by design. Only the prefix is shown here, which identifies the kind of key without identifying the key.
API keys
3 active · 1 revoked| Key | Type | Prefix | Mode | Last used | Status |
|---|---|---|---|---|---|
key_hQ47L4OfGqzXmRA narrowed key for one job — grant it only the scopes that job needs. | restricted | rk_test_····secret never shown again | test | 10 Sep 2026, 07:49 UTC2 h 12 min ago | active |
key_6KWLYEStf4JJVNFull server-side authority. Never ship it to a browser or a mobile app. | secret | sk_test_····secret never shown again | test | 10 Sep 2026, 08:06 UTC1 h 55 min ago | active |
key_uqDNf6LFmPTyXyRead-only and checkout-facing. Safe in a page the customer loads. | publishable | pk_test_····secret never shown again | test | 10 Sep 2026, 08:07 UTC1 h 54 min ago | active |
key_TCNhnurJOYkXdWFull server-side authority. Never ship it to a browser or a mobile app. | secret | sk_test_····secret never shown again | test | 07 Jun 2026, 08:09 UTC95 d 1 h ago | revoked13 Jun 2026, 08:09 UTC |
Rotating a key safely
Create the replacement first and deploy it, watch Last used on the old key go quiet, then revoke it. Revoking a key that something still holds returns 401 on the next request, and the request log will name the key prefix that failed.
Give every integration its own restricted key with only the scopes it needs. A fulfilment worker that reads payments does not need permission to move a wallet.