API keys
Ledgerline authenticates API requests with your account's API keys. A request without a key, or with a key that has been revoked, returns an authentication_error.
Key types
Type | Prefix | Where to use it |
|---|---|---|
Publishable |
| Client-side code: web pages and mobile apps |
Secret |
| Server-side code only |
Restricted |
| Microservices and third parties that need a subset of permissions |
Sandbox and live mode
Every key belongs to either a sandbox or live mode. Objects created with a sandbox key never touch the card networks, and objects from one mode can't be read with a key from the other.
A live secret key can move real money. Treat it like a password: store it in a secrets manager, restrict who can read it, and never paste it into a support ticket.
Rotate a key
Open Developers → API keys in the Dashboard.
Choose Rotate key on the key you want to replace.
Pick an expiry for the old key — now, or up to 7 days to give your deploys time to roll out.
Copy the new key and update your environment.
Restricted keys
Restricted keys grant per-resource permissions: None, Read or Write. Use them for any integration you do not fully control, such as an analytics vendor that only needs to read charges.