Skip to main content

Securing API keys

NOTE

Keep your API keys private and secure, and don't share them with anyone you don't trust. Anyone with your API key can call all Safepay Nordic APIs on your behalf.

Keep in mind when securing keys:

  • Don't leave API keys in publicly accessible places such as GitHub or client-side code. Only use them from your backend.
  • If you suspect that unauthorized people know a key, generate a new key in the portal right away. The old key stops working immediately.
  • Rotate your API keys periodically (see Rotating API keys).

Rotating API keys​

You can generate a new API key in the Safepay Nordic portal at any time. Generating a new key replaces the old one, and the old key stops working immediately, so requests still using it fail until you deploy the new key.

To rotate without downtime, ask Developer Support for a secondary API key. The primary and secondary keys work at the same time:

  1. Get a secondary API key from Developer Support.
  2. Update your integration to use the secondary key and deploy it.
  3. When nothing uses the primary key anymore, generate a new primary key in the portal. This cancels the old one.