​
Where API Keys Live

API keys are per-project. You manage them from each project’s detail page: Dashboard → Projects → [your project] → API Keys section There is no standalone “API Keys” menu item — keys always belong to a specific project.

​
Key Types

TypePrefixWhat happens
Testtest_Sandbox — no real money; test phone number works; completes instantly
Livelive_Production — real USSD sent; real money moves

​
Creating a Key

  1. Go to payments.rohopay.com → Projects
  2. Click the project you want to integrate
  3. In the project detail page, click Generate Key in the API Keys section
  4. Choose Test or Live
  5. Add an optional label (e.g., “Server – Production”)
  6. Copy the key immediately — it is never shown again

​
Key Display

After creation, only the prefix is stored and shown (e.g., test_abc123••••••). If you lose the key, you must generate a new one.

​
Revoking a Key

Click the revoke icon next to any key in the project detail page. Revoked keys return 401 UNAUTHORIZED immediately — there is no grace period.

​
Rotating a Key

Key rotation generates a fresh key and revokes the old one atomically. Use it when a key may have been exposed:
  • Dashboard: Project detail → API Keys → Rotate button next to the key
  • API (session auth): POST /dashboard/projects/{id}/api-keys/{keyId}/rotate
The new raw key is returned once in the response.

​
Security Rules

Never put a live_ key in browser JavaScript, a mobile app bundle, or a public repo. Use Next.js API routes, Express middleware, or a backend server.
Create one live key per deployed service (your API server). Rotate when a team member with access leaves.
On Vercel: Environment Variables (encrypted). On Railway/Render: Secret env vars. Never hardcode in source.