Credentials & environments

ArcenPay credentials follow the same mental model as Stripe: what leaks matters less than what it can do.

Credential	Prefix	Trust boundary	Permissions
Secret key	`sk_live_…` / `sk_test_…`	Server only	Full, or the explicit permission list you assign
Restricted key	`rk_live_…` / `rk_test_…`	Server only	Only the permissions you grant (e.g. `customers.read`)
Publishable key	`pk_live_…` / `pk_test_…`	Browser	Read-only, client-safe endpoints only
Temporary access token	`arc_tok_…`	Browser/embed	One company, expires in 60–900s
Webhook signing secret	`whsec_…`	Your server	Verify incoming HMAC-SHA256 webhook payloads

Environments

Keys are bound to a workspace environment:

Publishable keys never authorize money movement or private reads — endpoints opt in via key-type allow-lists.
Server keys are stored as SHA-256 hashes and shown once at creation.
Restricted keys require at least one permission; secret keys without permissions are full-access.
Keys can expire and can be revoked on demand; lastUsedAt is tracked.
Temporary access tokens are minted only with a secret/restricted key and are company-scoped + short-lived.

See Authentication & credentials for SDK setup, curl examples, and the temporary-token minting endpoint.

Last modified on September 17, 2026