API Keys

GoPayLocal uses two types of API keys for different purposes.

Key Types

Type	Prefix	Purpose	Safe for Client?
Public Key	gpl_pk_*	Banner script, SDK initialization	Yes
Secret Key	gpl_sk_*	Server-side API access	No

Public Keys

Public keys are used in the banner script and SDK initialization. They can only read banner configuration data and are safe to include in client-side code.

<!-- Public key in script tag — safe -->
<script src="https://api.gopaylocal.com/v1/banner/script.js?key=gpl_pk_live_abc123" async></script>

// Public key in React — safe
<GoPayLocalProvider apiKey="gpl_pk_live_abc123">

Secret Keys

Secret keys provide full CRUD access to the GoPayLocal API. They must be kept on your server and never exposed to the client.

# Secret key in server-side code — keep secure
curl -H "Authorization: Bearer gpl_sk_live_xyz789" \
  https://api.gopaylocal.com/v1/products

Danger

Never expose secret keys in client-side code, public repositories, or frontend bundles. If a secret key is compromised, revoke it immediately and generate a new one.

Managing Keys

Generate a Key

1. Go to app.gopaylocal.com > Settings > API Keys
2. Click Generate Key
3. Choose the key type (Public or Secret)
4. Give it a descriptive name (e.g., “Production Banner”, “CI/CD Pipeline”)
5. Copy the key — it is only shown once

List Keys

View all active keys with their names, types, creation dates, and last-used timestamps.

Revoke a Key

Click Revoke next to any key to permanently disable it. Revoked keys cannot be re-enabled.

Caution

Revoking a public key will immediately break any banners or SDK instances using that key. Make sure to update your code before revoking.

Key Rotation

To rotate keys safely:

1. Generate a new key
2. Update your code to use the new key
3. Deploy the changes
4. Verify the new key works
5. Revoke the old key

Environment-Specific Keys

Use different keys for different environments:

Environment	Key Name	Prefix
Development	Dev Banner	gpl_pk_test_*
Staging	Staging Banner	gpl_pk_test_*
Production	Production Banner	gpl_pk_live_*

Test keys (gpl_pk_test_*) use sandbox data and do not count against your API quota.