An API key is a credential that identifies your business when your website, app, or plugin communicates with Conekta. It works like the username and password of your integration: without the right key, Conekta doesn't process the transaction.
Public key and private key
- Public key: used in the buyer's browser or app to securely start a payment. It's designed to be visible and doesn't allow moving money.
- Private key: lives only on your server and authorizes sensitive operations: creating charges, issuing refunds, looking up customers. Whoever has this key can operate your account through the API.
In addition, each environment has its own pair of keys: test keys only work for simulated transactions, and production keys for live charges.
Where to find them
You can view and regenerate your account's keys from the Conekta Panel:
En Panel Conekta: Developers → API Keys
What you need to do
- Give the keys to your developer through a secure channel, and only the ones for the environment they need.
- Use test keys while the integration is being built and validated.
- Regenerate the keys if someone with access leaves your team.
The complete technical reference on authentication is at developers.conekta.com. For safekeeping practices, see How to protect my integration credentials.