API keys
Keys identify your merchant account and the network they operate on.
Test vs live
ak_test_…— operate against a testnet with no real funds.ak_live_…— operate against mainnet with real funds.
The prefix is the only difference in your code, so you can validate an integration on testnet and promote it by swapping the key.
Rotation
Keys can be rotated at any time; issue a new one, deploy it, then disable the old one. Because keys are tenant-scoped, a leaked key exposes only that merchant’s data and is contained by disabling it.
Storage
Store keys as server-side secrets (environment variables or a secret manager). Never commit them or ship them to a browser.