Authentication

MuPag keeps a strict line between public keys and server-side credentials.

sk_* for authenticated operations

Use Authorization: Bearer sk_test_... in QA. sk_prd_... keys and the prd environment are not available yet; do not simulate or configure them. Secret keys belong to your backend, workers and jobs.

Card tokenization outside hosted checkout

In the direct B2B flow, the merchant obtains the card token from Asaas, outside MuPag, and sends only that token to the authenticated MuPag backend. Tokenization credentials never replace sk_*.

Hosted checkout sessions can offer single-payment cards through the official Asaas invoice when the merchant has an available real integration. The buyer opens the session's hosted_payment_url; card details remain on the Asaas page. Create sessions with a server key or a publishable key limited to the checkout_sessions.create scope, as described in the checkout guide. Never expose a secret key in the browser.

Operational rules

• Never send sk_* from the browser.
• Never place secrets in URLs, query strings or screenshots.
• Send Idempotency-Key on POST operations.
• If you rotate credentials, allow a short overlap window and clear old caches.