paytrack docs
API keys
Create, scope, rotate, and revoke paytrack API keys safely.
Creating keys
Open Developer, then API keys. Choose a clear name, select test or live mode, and grant only the scopes required by that integration.
After creation, paytrack shows the raw key once with copy, reveal, and download actions. Store it in your secret manager or environment variables immediately.
Scopes
Scopes limit what a key can do. Examples include customers:read, customers:write, tracks:read, payments:write, reports:read, reminders:send, ledger:read, and webhooks:manage.
Plan limits
Your subscription controls how many active keys you can create and which scopes are available.
Revoking keys
Revoking a key immediately stops future requests. Revoked keys return 401 Unauthorized. Create a replacement key and deploy it before revoking old production keys.
Security best practices
- Use test keys locally and live keys only on servers.
- Never commit keys to GitHub, mobile apps, frontend bundles, screenshots, or support chats.
- Use one key per integration so revocation has a smaller blast radius.
- Rotate keys after staff changes, vendor changes, or suspected exposure.