API keys

Create keys from API keys. A secret key is shown once, when you create it: keep it on your server and never in a web page or an app.

Publishable keys

A publishable key can only open a checkout, and only from the websites you list for it. It is safe in a web page.

Limits

Every key has calls per minute and per day, and may have a list of IP addresses it works from. A call over a limit is answered with 429 and the time to wait.