VNSwitch authenticates every request with a key sent in the api-key HTTP header. You get your keys from the VNSwitch dashboard after onboarding. Sandbox and production keys are different.

Key types

KeyWhere to use itWhat it can do
Secret API keyYour servers onlyEvery operation in this documentation
Publishable keyBrowser or mobile appOnly client-side steps for one payment, together with that payment’s client_secret (for example confirming a payment or listing the payment methods available for it)
Payment response hash keyYour servers onlyNot sent to VNSwitch. Used to verify webhook signatures

Never put the secret API key in a web page, a mobile app or a public repository. Anyone holding it can create payments and refunds on your account. If a key leaks, revoke it in the dashboard and create a new one.

Client secret

Every payment response includes a client_secret. It lets a browser or app act on that single payment, with the publishable key, without seeing your secret key. Pass it to the front end only for the customer who owns the payment, and never log it.

Keep keys safe

  • Load keys from environment variables or a secrets manager, as in the examples.
  • Use separate keys per environment and rotate them on a schedule.
  • Call the API only over HTTPS. Plain HTTP requests are rejected.