Skip to main content
ArcenPay credentials follow the same mental model as Stripe: what leaks matters less than what it can do.
The legacy api_… key prefix has been removed. Regenerate any old api_… keys as sk_… / rk_… / pk_… — they no longer authenticate anywhere.

​
Environments

Keys are bound to a workspace environment:
  • Production environments create *_live_* keys (real payments).
  • Development environments create *_test_* keys (test flows).

​
Security invariants

  1. Publishable keys never authorize money movement or private reads — endpoints opt in via key-type allow-lists.
  2. Server keys are stored as SHA-256 hashes and shown once at creation.
  3. Restricted keys require at least one permission; secret keys without permissions are full-access.
  4. Keys can expire and can be revoked on demand; lastUsedAt is tracked.
  5. Temporary access tokens are minted only with a secret/restricted key and are company-scoped + short-lived.

​
Which key works where

Which credential you use depends on the endpoint. The endpoint auth matrix in API keys and authentication lists every endpoint group and the keys it accepts today. See Authentication & credentials for SDK setup, curl examples, and the temporary-token minting endpoint.
Last modified on September 19, 2026