API keys
PAID uses Bearer authentication. Every request to api.trustfabric.ai must include your
secret key in the Authorization header (or as the username in HTTP Basic).
Key types
| Prefix | Mode | Use |
|---|---|---|
sk_live_… | Live | Real charges, real settlement. |
sk_test_… | Test | Simulated charges. No real money moves. |
pk_live_… | Live (public) | Safe to embed in client-side code. Cannot create charges directly. |
Best practices
- Never commit a secret key to a repository.
- Store secret keys in your platform's secret manager (Render env vars, AWS Secrets Manager, etc).
- Rotate keys when an employee leaves or you suspect a compromise.
- Scope keys by environment — never use a live key in CI or local development.
Treat
sk_live_… like a database password. PAID will roll any key on demand from
the dashboard; an unrecognized rotation is your signal to investigate.