API keys

Every request authenticates with a Bearer key. Keys come in two types, each

scoped to a mode (test or live); an intent's mode is set by the key that

created it.

Platform-wide concepts (auth, idempotency, versioning, errors) live on the

Key types

Type	Prefix	Scoping	Use case
Secret	`sk_test_…` / `sk_live_…`	Full account access, TLS only	Server-side: intents, webhooks, links
Publishable	`pk_test_…` / `pk_live_…`	Create intents + drive hosted checkout only	Client-side: checkout embed

Publishable keys are forbidden everywhere else

(permission_error / publishable_key_forbidden). Rate limits on intent

creation: secret 10,000 req/min, publishable 120 req/min.

Request:


POST /api-keys
Authorization: Bearer sk_test_...
Content-Type: application/json

{ "type": "secret", "mode": "test" }

Response (200):


{
  "key": {
    "id": "key_...",
    "mode": "test",
    "type": "secret",
    "plaintext": "sk_test_..."
  }
}

The plaintext is returned once only — store it. Later listings show only

the prefix.

List keys (ID, type, mode; values masked).

Issue a new secret that shadows the old for 72h before the old stops working.

Revoke a key immediately.

Code examples:

Language	Example
Python	`transxact.api_keys.create({"mode": "test"})`
Node.js	`await transxact.apiKeys.create({ mode: "test" })`

You can also self-serve keys in the Developer section of the

dashboard without writing any code.