> ## Documentation Index
> Fetch the complete documentation index at: https://docs.arcenpay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials & environments

> Stripe-style credentials: secret, publishable and restricted keys with test/live prefixes, plus company-scoped temporary access tokens.

ArcenPay credentials follow the same mental model as Stripe: **what leaks matters less than what it can do**.

| Credential             | Prefix                    | Trust boundary | Permissions                                            |
| ---------------------- | ------------------------- | -------------- | ------------------------------------------------------ |
| Secret key             | `sk_live_…` / `sk_test_…` | Server only    | Full, or the explicit permission list you assign       |
| Restricted key         | `rk_live_…` / `rk_test_…` | Server only    | Only the permissions you grant (e.g. `customers.read`) |
| Publishable key        | `pk_live_…` / `pk_test_…` | Browser        | Read-only, client-safe endpoints only                  |
| Temporary access token | `arc_tok_…`               | Browser/embed  | One company, expires in 60–900s                        |
| Webhook signing secret | `whsec_…`                 | Your server    | Verify incoming HMAC-SHA256 webhook payloads           |

## Environments

Keys are bound to a workspace environment:

* **Production** environments create `*_live_*` keys (real payments).
* **Development** environments create `*_test_*` keys (test flows).

## Security invariants

1. Publishable keys never authorize money movement or private reads — endpoints opt in via key-type allow-lists.
2. Server keys are stored as SHA-256 hashes and shown **once** at creation.
3. Restricted keys require at least one permission; secret keys without permissions are full-access.
4. Keys can expire and can be revoked on demand; `lastUsedAt` is tracked.
5. Temporary access tokens are minted only with a secret/restricted key and are company-scoped + short-lived.

See [Authentication & credentials](/api/authentication) for SDK setup, curl examples, and the temporary-token minting endpoint.