Keeping API keys and webhooks safe

Secret keys (sk_…) belong on your server, in a secret store, never in a repository, a mobile app or front-end JavaScript. Publishable keys (pk_…) are the ones safe to ship to a browser.

Roll a key whenever someone leaves, a laptop goes missing, or a key might have been logged. Rolling is designed to be routine.

Verify every webhook signature before trusting the payload, and process events idempotently — deliveries are at-least-once and order is not guaranteed.

Give developers the developer role. It can manage keys and webhooks but cannot move money, which limits the blast radius of any single compromise.