Keep Your EPaySe Secret Key Away From Your AI Assistant

Your secret key is the password that proves a request to EPaySe really comes from your shop. Never paste the live key into a chat with an AI assistant, and never write it into your code. Keep it in your server settings, where only your shop can read it, and replace it right away if you think it leaked.

• What it does: proves a request really comes from your shop.
• Where it goes: your server settings, not the code and not a chat.
• If it leaks: replace it immediately.

What is a secret key?

When your shop talks to EPaySe, EPaySe needs to know the request is genuine. Your shop adds a signature made with your secret key. EPaySe checks it and accepts or rejects the request. The key itself is never sent. Anyone who has the key can create requests that look like they came from you.

Why not paste it into a chat?

A chat with an AI assistant is not a safe place for a live secret. The text can be stored, shown in logs, copied into other files or shared by accident. You also cannot easily take it back. The assistant does not need the real key to write the code. It only needs to know where the code will read the key from.

Where should the key live?

• In your server settings, for example an environment variable or a secrets store.
• Not in the code, so it never ends up in a code repository.
• Not in screenshots or logs, which are easy to share by mistake.

Ask the assistant to read the key from a setting, for example "read the key from an environment variable called EPAYSE_SECRET". You then add the real value on your server yourself.

What should you use while building?

Use sandbox credentials. They cannot move real money, so a mistake with them costs nothing. Switch to the live key only on your live server, at the very end. See test your EPaySe integration in the sandbox.

What if the key leaks?

Treat it as lost. Anyone holding it can act as your shop. Replace it as soon as you can in your EPaySe account, update your server settings, and check recent activity for anything you do not recognise. If you are unsure how, contact the team.

What else should you check?

Search your project for the key before you save or share it. Read through the code the assistant wrote and look for any hard-coded secret. Our guide to what to check in payment code your AI wrote covers more.

EPaySe is an early-stage payment gateway, still in development. Read the documentation for the latest details.

Key takeaways

• The secret key proves requests come from your shop.
• Never paste the live key into a chat or write it into code.
• Keep it in server settings, and use sandbox keys while building.
• Replace it right away if it leaks.
• This is general education, not security or legal advice.

FAQ

What is the EPaySe secret key?

It is a private value that your shop uses to sign requests, so EPaySe knows they really come from you.

Can I paste my live key into an AI chat?

No. Keep the live key out of chats and out of your code, and store it in your server settings instead.

How does the assistant write code without the key?

It writes code that reads the key from a setting, and you add the real value on your server yourself.

What should I do if my key leaks?

Replace it in your EPaySe account, update your server settings and check recent activity for anything unusual.

Which key should I use while building?

Use sandbox credentials, which cannot move real money.