Getting credentials
Merchant credentials are provisioned through merchant onboarding after the business, storefront, integration scope, and expected use are reviewed.
Where secret keys belong
Secret API credentials belong only in the merchant server environment or secret manager. Do not embed them in browser JavaScript, mobile bundles, screenshots, support tickets, or public repositories.
Scope
Credentials are merchant-scoped. The server derives merchant authorization from the authenticated credential rather than trusting a merchant identifier supplied by a browser.
Rotation
Treat credential rotation as a controlled server-side change. Update the receiving environment first, verify the new credential, then retire the old credential according to the onboarding guidance provided for your integration.