Logo GenukaGenuka Pay
Guides

Manage API Keys

Manage your Genuka Pay application credentials safely from the dashboard and operational workflows.

Introduction

Genuka Pay is designed to be managed from the dashboard first, not by pasting raw credentials into ad hoc scripts.

Reveal Credentials

Inspect your current application keys from the protected dashboard flow.

Operational Review

Review recent rotations and application activity before changing live credentials.

Rotate Secrets

Rotate secrets intentionally when exposure, access, or deployment context changes.

Dashboard Entry Point

Open the API Keys page from the dashboard.

Use this page to:

  • viewing the public_key
  • revealing or hiding the secret_key
  • copying credentials safely
  • rotating the secret key
  • reviewing key history and recent activity
  1. copy the current secret_key
  2. store it in your backend environment variables or secrets manager
  3. keep the key server-side only
  4. rotate it when access changes or you suspect the key may have been exposed

Headers Used With the Key

Authenticated Request Headers
X-Public-Key: YOUR_PUBLIC_KEY
X-Timestamp: UNIX_TIMESTAMP
X-Signature: HMAC_SHA256_SIGNATURE

Accepted environment values are SANDBOX and LIVE.

Automation Endpoints

If you need internal tooling or scripted workflows, the backend also exposes:

  • GET /api/v1/application
  • POST /api/v1/application/rotate

Example Application Inspection

Inspect Current Application
curl -X GET "{{BASE_URL}}/api/v1/application" \
  -H "X-Public-Key: YOUR_PUBLIC_KEY" \
  -H "X-Timestamp: UNIX_TIMESTAMP" \
  -H "X-Signature: HMAC_SHA256_SIGNATURE"

Environment Guidance

  • use SANDBOX for testing and staging
  • use LIVE only for production traffic
  • do not mix webhook receivers across environments
  • verify the selected environment before rotating or distributing a key

Security rule

Never place the secret key in browser code, static assets, mobile apps, screenshots, public repositories, or support tickets.

Operational Checklist

  • store secrets in a secure backend-only location
  • limit which services can read them
  • rotate when access changes
  • validate production traffic after every rotation
  • keep deployment runbooks in sync with key management procedures

How is this guide?