Keep your API keys safe

Treat live keys like passwords: keep them server-side, rotate often, and revoke instantly if exposed.

Last updated June 1, 2026

Your live API key can create real payment collections, so guard it like a password.

Where to keep keys

Store keys in server-side environment variables, never in client-side code.
Never commit a key to source control. If you do, rotate it immediately.
Use your test key (test_) for development and your live key (live_) only in production.

Rotate and revoke

Open Settings, then Developer, then API Keys.
Rotate a key on a schedule, and any time a teammate with access leaves.
Revoke a key the moment you suspect it's exposed, revocation is instant.

Update your servers with the new key before you revoke the old one to avoid downtime.

Lock down webhooks too

Verify the X-Boldswitch-Signature header on every webhook with your webhook secret before processing it. Reject anything with a missing or mismatched signature.

Tip: Limit who on your team can view keys, and review access whenever your team changes.

What's next

See Create and manage your API keys.
See Set up and verify webhooks.

Questions? Email support@boldswitch.ng.

Was this article helpful?