Skip to main content
Merchant API keys are managed from the merchant dashboard.

​
Find API keys

  1. Sign in as a merchant.
  2. Open Settings.
  3. Select API keys.
  4. Check whether the dashboard is showing sandbox or production.
  5. Copy the key your integration needs.
When you create a key, Sarafa shows the API secret and its whsec_* webhook secret once. Store both on your server. Sarafa cannot show them again. API keys

​
Key types

​
Key safety

  • Store secret keys only on your server.
  • Do not expose secret keys in websites or shared screenshots.
  • Rotate keys if they may have been exposed.
  • Rotate keys created before signed callback support; their webhook secrets cannot be recovered for callback delivery.
  • Use different keys for sandbox and production.
Last modified on July 22, 2026