Authentication

MuPag keeps a strict line between public keys and server-side credentials.

sk_* for authenticated operations

Use Authorization: Bearer sk_test_... in sandbox. sk_live_... keys and the live environment are not available yet; do not simulate or configure them. Secret keys belong to your backend, workers and jobs.

pk_* only for card tokenization

When checkout needs card tokenization, use the approved PSP tokenization flow. A pk_* key never replaces sk_* for merchant API calls.

Operational rules

• Never send sk_* from the browser.
• Never place secrets in URLs, query strings or screenshots.
• Send Idempotency-Key on POST operations.
• If you rotate credentials, allow a short overlap window and clear old caches.