API Keys

API keys are essential for authenticating with Moosyl's services. This guide covers how to manage, secure, and use your API keys effectively.

Overview

Moosyl provides two types of API keys:

Publishable Keys (pk_...): Safe for client-side use (Flutter, React apps)
Secret Keys (sk_...): Must be kept secure, only for backend use

Getting Your API Keys

Visit moosyl.com and create an account
Complete the account verification process
Access your dashboard

2. Generate API Keys

Navigate to API Keys in your dashboard
Click "Create New Key"
Choose key type:
- Publishable Key (for client-side)
- Secret Key (for backend)
Copy and store securely

3. Test vs Live Keys

Test Keys (pk_test_..., sk_test_...): For development and testing
Live Keys (pk_live_..., sk_live_...): For production transactions

Key Types Explained

Publishable Keys

Format: pk_test_... or pk_live_...

Usage:

Initialize payment interfaces in Flutter/React apps
Safe to expose in client-side code
Cannot perform sensitive operations

Example:

// Flutter
MoosylView(
  publishableApiKey: 'pk_test_1234567890abcdef',
  transactionId: 'txn_123',
  // ... other properties
)

// React
<MoosylProvider publishableKey="pk_test_1234567890abcdef">
  <PaymentForm />
</MoosylProvider>

Secret Keys

Format: sk_test_... or sk_live_...

Usage:

Create payment requests
Verify webhook signatures
Access sensitive account data
Must be kept secure

Example:

// Node.js Backend
const response = await fetch('https://api.moosyl.com/payment-request', {
  method: 'POST',
  headers: {
    'Authorization': 'sk_test_1234567890abcdef',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    amount: 5000,
    transactionId: 'txn_123',
  }),
});

Security Best Practices

🔒 Keep Secret Keys Secure

❌ Never do this:

// DON'T: Expose secret key in client code
const secretKey = 'sk_live_1234567890abcdef'; // NEVER!

✅ Do this instead:

// DO: Use environment variables
const secretKey = process.env.MOOSYL_SECRET_KEY;

🔄 Rotate Keys Regularly

Generate new keys in your dashboard
Update your applications with new keys
Revoke old keys after confirming new ones work
Test thoroughly before revoking old keys

🏗️ Use Different Keys for Different Environments

Development:

MOOSYL_SECRET_KEY=sk_test_dev_1234567890abcdef
MOOSYL_PUBLISHABLE_KEY=pk_test_dev_1234567890abcdef

Staging:

MOOSYL_SECRET_KEY=sk_test_staging_1234567890abcdef
MOOSYL_PUBLISHABLE_KEY=pk_test_staging_1234567890abcdef

Production:

MOOSYL_SECRET_KEY=sk_live_1234567890abcdef
MOOSYL_PUBLISHABLE_KEY=pk_live_1234567890abcdef

🔍 Monitor Key Usage

Check dashboard logs for API key usage
Set up alerts for unusual activity
Review access patterns regularly
Monitor failed authentication attempts

Environment Setup

Flutter/React Apps

Environment Variables (.env file):

MOOSYL_PUBLISHABLE_KEY=pk_test_1234567890abcdef

Usage:

// Flutter
final publishableKey = const String.fromEnvironment('MOOSYL_PUBLISHABLE_KEY');

// React
const publishableKey = process.env.REACT_APP_MOOSYL_PUBLISHABLE_KEY;

Backend Services

Environment Variables:

MOOSYL_SECRET_KEY=sk_test_1234567890abcdef
MOOSYL_PUBLISHABLE_KEY=pk_test_1234567890abcdef

Usage:

// Node.js
const secretKey = process.env.MOOSYL_SECRET_KEY;
const publishableKey = process.env.MOOSYL_PUBLISHABLE_KEY;

# Python
import os
secret_key = os.getenv('MOOSYL_SECRET_KEY')
publishable_key = os.getenv('MOOSYL_PUBLISHABLE_KEY')

Key Management

Creating New Keys

Log into your dashboard
Go to API Keys section
Click "Create New Key"
Select key type and environment
Set expiration date (optional)
Copy the key immediately

Revoking Keys

Find the key in your dashboard
Click "Revoke"
Confirm the action
Update your applications with new keys

Key Permissions

You can restrict key permissions for enhanced security:

Payment Creation: Create payment requests
Webhook Verification: Verify webhook signatures
Account Access: Read account information
Transaction History: Access transaction data

Testing Your Keys

Verify Publishable Key

// Test if publishable key is valid
const response = await fetch('https://api.moosyl.com/account', {
  headers: {
    'Authorization': 'pk_test_1234567890abcdef',
  },
});

if (response.ok) {
  console.log('Publishable key is valid');
} else {
  console.log('Invalid publishable key');
}

Verify Secret Key

// Test if secret key is valid
const response = await fetch('https://api.moosyl.com/payment-request', {
  method: 'POST',
  headers: {
    'Authorization': 'sk_test_1234567890abcdef',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    amount: 100, // Small test amount
    transactionId: 'test_' + Date.now(),
  }),
});

if (response.ok) {
  console.log('Secret key is valid');
} else {
  console.log('Invalid secret key');
}