API Key Security

What is the API key?

Your API key lets server-side code create payment links on your behalf. It looks like brykto_live_sk_....

Keep your key private

Your API key should never appear in:

• Public GitHub repositories or source code
• Client-side JavaScript (browser code)
• Shared or logged files

Anyone with your API key can create payment links in your name.

Rotating your key

If you believe your key has been exposed, rotate it immediately:

1. Go to Developers in your dashboard.
2. Click Rotate API key.
3. Confirm the rotation.
4. Update your server with the new key.

The old key is invalidated immediately when you rotate.

Storing your key

Store your API key as an environment variable on your server. Do not hard-code it into your application source.

# Example - set in your server environment
BRYKTO_API_KEY=brykto_live_sk_...