API keys
Create and manage public and secret keys for integrations.
API keys connect merchant tools to Yera Connect.
They allow WooCommerce, hosted checkout, payment links, and custom backend integrations to create checkout sessions and communicate securely with Yera Connect.
Key types
- Public key - identifies the merchant or integration. This can be used by client-facing flows when required.
- Secret key - authenticates secure server-side requests. This must stay private.
Never expose secret keys on the storefront, in browser JavaScript, or in public repositories.
Sandbox keys and live keys
Use sandbox keys for testing. Sandbox keys help merchants test checkout without real production payment risk.
Use live keys only after:
- Company profile is complete.
- Account is approved for live use.
- Wallet is verified.
- Settlement asset is selected.
- Webhooks have been tested.
- A sandbox checkout has worked from start to finish.
Keep sandbox and live keys separate. Do not paste live keys into a staging website unless you intentionally want that environment to create live checkout sessions.
Recommended key names
Use clear names:
- WooCommerce sandbox
- WooCommerce live
- Payment links API
- Hosted checkout API
- Backend integration
Good key names make support and rotation easier. If a key is compromised, the merchant can identify which integration is affected.
WooCommerce keys
For WooCommerce, merchants normally add both:
- Yera Connect public key
- Yera Connect secret key
The plugin uses the keys to create checkout sessions and verify the store connection.
The secret key should only be stored inside WordPress admin plugin settings. It must not be printed on the storefront or included in JavaScript.
Custom API keys
For custom integrations, the backend should send requests to Yera Connect using the secret key.
Common custom integration use cases:
- Create hosted checkout sessions from a backend.
- Attach order metadata to a checkout session.
- Track payment session status.
- Receive webhook events in the merchant system.
- Reconcile Yera transactions with internal order records.
When to rotate a key
Rotate keys when a secret is shared with the wrong person, committed to code, exposed in logs, or used by an old integration that is no longer trusted.
Safe key handling
Merchants should:
- Copy keys only from the Yera Connect dashboard.
- Store secret keys in server-side settings only.
- Limit access to administrators.
- Rotate keys if staff access changes.
- Delete old keys that are no longer used.
- Avoid sharing keys over chat or email when possible.