Title here
Summary here
VNSwitch authenticates every request with a key sent in the api-key HTTP header. You get your
keys from the VNSwitch dashboard after onboarding. Sandbox and production keys are different.
| Key | Where to use it | What it can do |
|---|---|---|
| Secret API key | Your servers only | Every operation in this documentation |
| Publishable key | Browser or mobile app | Only client-side steps for one payment, together with that payment’s client_secret (for example confirming a payment or listing the payment methods available for it) |
| Payment response hash key | Your servers only | Not sent to VNSwitch. Used to verify webhook signatures |
Never put the secret API key in a web page, a mobile app or a public repository. Anyone holding it can create payments and refunds on your account. If a key leaks, revoke it in the dashboard and create a new one.
Every payment response includes a client_secret. It lets a browser or app act on that single
payment, with the publishable key, without seeing your secret key. Pass it to the front end only
for the customer who owns the payment, and never log it.