English
Türkçe
Русский
Українська
Deutsch
Français
Español
Português
Italiano
한국어
中文
العربية認証
シークレットキー、公開可能キー、そしてテストと本番を分ける境界線。
まだ公開していません — api.baynoy.com は名前解決されないため、以下のサンプルは現時点では実行できません。この形式は確定済みです。今のうちにこの仕様で設計しておけば、本番キーに切り替えても変更は不要です。
Two key types, one rule
Secret keys (sk_) authenticate your server and can do anything your role allows. Publishable keys (pk_) are safe in a browser and can only start a checkout. If a secret key can reach a browser, it is already compromised.
# server-to-server: secret key, never in a browser or an app bundle
Authorization: Bearer bk_live_...
# browser: publishable key, safe to ship, can only start a checkout
Authorization: Bearer pk_live_...Test and live are separate universes
bk_test_ keys operate on simulated money and never touch live data; bk_live_ keys move real money. There is no flag that turns one into the other, which is deliberate — the environments cannot be mixed by accident.
Scopes and rolling
Payouts, refunds and card reveal require separately scoped keys. Roll a key whenever someone leaves or a key might have been logged; rolling is designed to be routine maintenance, not an incident.