Keep Merchant API Secrets Out of Public Code and Shared Chats

An API secret should be treated like a password for your integration. If it appears in a public repository or shared message, someone else may be able to misuse it.

Begin by writing down the current situation in plain language: what needs to happen, who is involved and what is already known. For this guide, that means starting with “Store secrets in environment configuration or a managed secret store, not in browser code.” Keep confirmed details separate from estimates or assumptions. A dated note, transaction reference or agreed group record gives everyone the same starting point and makes later questions easier to answer.

Next, turn the idea into one small action with an owner and a review date. Protect integration credentials with private storage, limited access and a response plan for accidental exposure. If another person needs to take part, agree on the purpose and the information they need before acting. Use the same names, dates and references in each record so a family member, group officer or colleague can follow the decision without relying on memory.

A practical checklist

1. Store secrets in environment configuration or a managed secret store, not in browser code.
2. Limit access to staff and systems that need the credential.
3. Use separate credentials for testing and live operations where provided.
4. If a secret is exposed, follow the merchant dashboard process to rotate it and review activity.

Review, record and adjust

At the review, compare the plan with what actually happened. Check whether the agreed action was completed, whether any amount, date or responsibility changed, and whether someone is waiting for an update. Record the result and the next action while the details are fresh. If circumstances changed, revise the plan openly and agree who will communicate the change. Review access when a developer or vendor leaves the project, and never paste live secrets into a support request.

Review access when a developer or vendor leaves the project, and never paste live secrets into a support request.