Configuración
API keys
Generate the keys your own systems use to connect to the Recaudo API.
Before you start
Keys live in Settings › Advanced › API keys. You need someone to build the integration; if you only want to be notified about what happens in your account, also check webhooks.
Key types
Every time you generate keys you get a pair, and there is one pair per environment:
- Secret key (
sk_live_…orsk_test_…): authenticates your API calls. Use it only on your server. - Public key (
pk_live_…orpk_test_…): identifies your account in the browser or app. - Production (
live) moves real money and data; test (test, sandbox) is for building without real charges.
Generate your keys
Generate test keys first and, once your integration works, the production ones.
-
Open API keys
Go to Settings, open Advanced and choose API keys. -
Pick the environment
Find the Test API keys (sandbox) or Production API keys section and click Generate keys. -
Copy the keys
Under API keys generated copy the publishable and secret keys and store them somewhere safe (for example, your server environment variables). -
Note your account ID
The same page shows Your account ID, in case your integration needs it.
Careful
Keys are shown only once. After that you will only see the prefix and the last 4 characters. If you lose the secret key, generate a new pair and revoke the old one.
Use the key in your calls
Send the secret key in the Authorization header of every request:
Authorization: Bearer sk_test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
curl https://recaudo.app/api/v1/customers \
-H "Authorization: Bearer sk_test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
-H "Accept: application/json"
Endpoints, errors and pagination are in the API authentication reference.
Change or revoke a key
There is no rotate button: to change a key, generate a new one and revoke the old one.
-
Generate a new pair
In the same environment click Generate keys and copy the new ones. -
Update your system
Replace the key on your server and confirm your calls still work. -
Revoke the old one
In the list, click Revoke next to the old key. Calls using it stop working immediately.
Tip
Never put the secret key in a web page, a mobile app or a code repository. If you think someone saw it, revoke it right away.
Next steps
Was this page helpful?
Thanks for letting us know.