A Coinvay merchant API key authorizes backend access to merchant operations. Treat it as a secret: keep it on a trusted server, restrict where it is used and revoke it promptly if it is exposed.
Choose the correct storage boundary
Create the key while signed in to Integration and save the complete value in your hosting provider’s secret controls. The dashboard returns the secret at creation; routine metadata views are not a way to recover it. Avoid hardcoding keys in a public repository, browser bundle, mobile app, HTML source or download. Sending a bearer key through a URL can also expose it through logs, referrers and copied links. Use the documented Authorization header over HTTPS.
Reduce the number of places that hold it
For example, a store can use a single backend payment service to create invoices and reconcile orders, while the storefront receives only order status and checkout URLs. Separate credentials by deployment where your account limits allow, and label them so the operator knows which service uses each one. Do not give customer-facing forms unrestricted access to gateway operations just because the underlying key is hidden behind your backend.
Prepare a rotation and incident procedure
If a key appears in a log or source repository, assume that removing the visible copy does not remove every copy. Revoke the affected key, replace it in the intended backend and review unexpected invoices or requests. Coordinate changes so pending-order reconciliation can continue. Coinvay integration keys cannot mint replacement keys; creating credentials requires an interactive session. The interactive merchant Sandbox also rejects live API keys, so copying a production credential there is neither required nor a test-mode strategy.
Practical checklist
- Store the key only in protected backend configuration and redact it from logs.
- Limit customer-facing endpoints to validated order operations and trusted catalog prices.
- Document the key owner, dependent services, revocation steps and replacement verification.
Common questions
Is a merchant key safe in an environment variable exposed by my frontend build?+
No. Some build systems intentionally embed public environment variables into downloadable JavaScript. Verify that the variable stays server-only.
Can a stolen API key create another key?+
Coinvay requires interactive sign-in to create API keys. That restriction does not make a leaked existing key harmless; revoke it and review its use.
Sources and further reading
Primary references and Coinvay product documentation. Check the linked pages for current details.
AI-assisted drafting, published by Coinvay. Examples are illustrative. Read our editorial approach.