Manage API Keys
Manage your Genuka Pay application credentials safely from the dashboard and operational workflows.
Introduction
Genuka Pay is designed to be managed from the dashboard first, not by pasting raw credentials into ad hoc scripts.
Reveal Credentials
Inspect your current application keys from the protected dashboard flow.
Operational Review
Review recent rotations and application activity before changing live credentials.
Rotate Secrets
Rotate secrets intentionally when exposure, access, or deployment context changes.
Dashboard Entry Point
Open the API Keys page from the dashboard.
Use this page to:
- viewing the
public_key - revealing or hiding the
secret_key - copying credentials safely
- rotating the secret key
- reviewing key history and recent activity
Recommended Workflow
- open API Keys
- copy the current
secret_key - store it in your backend environment variables or secrets manager
- keep the key server-side only
- rotate it when access changes or you suspect the key may have been exposed
Headers Used With the Key
X-Public-Key: YOUR_PUBLIC_KEY
X-Timestamp: UNIX_TIMESTAMP
X-Signature: HMAC_SHA256_SIGNATUREAccepted environment values are SANDBOX and LIVE.
Automation Endpoints
If you need internal tooling or scripted workflows, the backend also exposes:
GET /api/v1/applicationPOST /api/v1/application/rotate
Example Application Inspection
curl -X GET "{{BASE_URL}}/api/v1/application" \
-H "X-Public-Key: YOUR_PUBLIC_KEY" \
-H "X-Timestamp: UNIX_TIMESTAMP" \
-H "X-Signature: HMAC_SHA256_SIGNATURE"Environment Guidance
- use
SANDBOXfor testing and staging - use
LIVEonly for production traffic - do not mix webhook receivers across environments
- verify the selected environment before rotating or distributing a key
Security rule
Never place the secret key in browser code, static assets, mobile apps, screenshots, public repositories, or support tickets.
Operational Checklist
- store secrets in a secure backend-only location
- limit which services can read them
- rotate when access changes
- validate production traffic after every rotation
- keep deployment runbooks in sync with key management procedures
How is this guide?