API key security best practices

Never expose your secret key

Your secret key (ik_live_sk_...) must never appear in frontend code, Git repositories, or client-side JavaScript. Use environment variables on your server.

Use environment variables

# .env
INZOPAY_SECRET_KEY=ik_live_sk_xxxxx

# PHP
$key = getenv('INZOPAY_SECRET_KEY');

Use restricted keys where possible

If a third-party service only needs to read payment data, create a restricted key with only the necessary scopes instead of sharing your full secret key.

Enable IP allowlist

In Developers → API Keys, add your server IP to the allowlist. This ensures API calls can only come from your server.

Rotate compromised keys immediately

If you suspect a key has been exposed, rotate it immediately from the API Keys page. The old key is invalidated instantly.