Your API keys are the keys to your account: whoever has the private key can operate on your behalf. Protecting them doesn't require sophisticated tools, just consistent habits. Keys are managed from the Conekta Panel:
En Panel Conekta: Developers → API Keys
Best practices
Keep keys out of your code
Use environment variables or a secrets manager. Never write the private key directly in your code or push it to a repository — not even a private one: it would stay in the history forever.
Separate environments
Use test keys for development and production keys only on your production server. That way a slip during development never touches real money, and you can immediately tell which environment each operation happens in.
Limit who knows them
Only the people who operate the integration need to see the keys. If a developer or agency stops working with you, rotate the keys that same day.
Rotate periodically
Generate new keys periodically and after any team change. Plan the rotation: first update the key in your systems and then invalidate the old one so you don't interrupt charges.
Next step
If you want to review what each key is and what it's for, see What are API keys.