API keys

API keys authenticate your server's requests to the Stridge API. Each key belongs to one environment, and its prefix tells you which:

Prefix	Environment	Secret
`sk_sbx_`	Sandbox	Can be revealed again from the key's details whenever you need it.
`sk_live_`	Live	Shown once, when you create the key. It can't be recovered.

Keys created before environments existed have no prefix. They keep working, in live.

You manage keys under Developer → API Keys. The page lists the keys of the environment you are in, so switch environments to see the others. See Environments.

Who can manage keys

	Sandbox keys	Live keys
Owner	Create, edit, rotate, revoke	Create, edit, rotate, revoke
Developer	Create, edit, rotate, revoke	Read only
Viewer	Read only	Read only

In live, creating or rotating a key that can move money (one with the Payouts or Transfers scope), or giving such a key more access, asks you to confirm with your authenticator app. Every owner of the workspace is emailed when that happens. See Two-factor and step-up.

Create a key

Open API Keys

Switch to the environment the key is for, then choose Developer → API Keys → Create API key.

Name the key and choose its scopes

Enter a Name, then pick the Scopes the key needs: Wallets, Deposits, Transfers, Vaults, Gas stations, Payouts, Transactions, Universal addresses and Gateway. Full access selects them all. Give a key only the scopes it uses.

If you pick Gateway, fill in Gateway configuration too: Same owner required and a Destination whitelist limit where gateway funds can settle. The gateway accepts live keys only, so a sandbox key with this scope is refused there. See Gateway keys.

Set access controls (optional)

Under Access controls:

Allowed IPs: exact IPv4 or IPv6 addresses the key may be used from. No ranges. Leave empty to allow all. See IP allowlist.
Referrer whitelist: bare domains or *.subdomain wildcards, without https://. Leave empty to allow all origins.

Pick an expiry

Under Expiry, choose 7 days, 30 days, 90 days or 1 year, or set a custom date.

Choose Create key and copy the secret

The dialog shows the full key. Choose Copy key and store it in a secret manager or your app's environment. For a live key, this is the only time you can see it. When you have it, choose I've copied my key.

To check the key works, use Copy cURL under Verify it works and run the request.

See a key's details

Select a key in the list to open its details: its scopes, access controls, lifecycle dates, usage, and its Key events, such as when it was created, rotated or revealed.

To see a sandbox key's secret again, open the key and choose Reveal secret. Each reveal is recorded in the audit log under your name. A live key has no Reveal secret: rotate it to get a new secret.

Edit a key

Open the key's actions (the ⋯ button on its row) and choose Edit API key. You can change its name, scopes, access controls and expiry, then choose Save changes.

An expired key can't be edited. Create a new key instead.

Rotate a key

Rotating issues a new secret while the old one keeps working for a grace period, so you can swap keys without downtime.

Choose Rotate API key

Open the key's actions and choose Rotate API key.

Name the new key and set the grace period

Enter a New key name. The new key copies the scopes, IP rules, referrers and gateway settings of the old one. Set the Grace period (days), from 1 to 30 days. The old key is revoked automatically when it ends.

Choose Rotate key and copy the new secret

Copy the new key, deploy it, and choose Done.

While the grace period runs, the old key shows as Rotating.

Revoke a key

Revoking stops a key working at once, and it can't be undone.

Open the key's actions and choose Revoke API key.
Choose Revoke key.

To cut off a key you have just rotated, choose Revoke the key in the rotation dialog.

Gateway keys

The Gateway Kit, the Gateway SDK, and the Gateway HTTP API authenticate with a gateway key. A gateway key is not a separate credential: it is the ID of a live API key that carries the Gateway scope. The ID is not the secret, and you can copy it again at any time. That alone doesn't make it safe to ship in a browser: anyone who copies it from your page can call the gateway with it. Before you put a gateway key in a browser, turn on Require same owner or set a destination whitelist, so funds can only settle where you allow. A key you create under API Keys has Require same owner off and an empty whitelist, which allows any destination. See Gateway Kit security.

The quickest way to get one is Developer → Gateway Kit → Create gateway kit. Enter a Brand name and, optionally, an Allowed origin, then choose Create key. This creates a key with only the Gateway scope and Require same owner turned on. Every key with the Gateway scope, including one you create under API Keys, is listed under Gateway Kit with its Gateway key.

	API key secret	Gateway key
What it is	The key's secret, `sk_sbx_…` or `sk_live_…`	The ID of a live key with the Gateway scope
Header	`X-API-Key`	`X-Gateway-Key`
Calls	The REST API	The gateway: Kit, SDK, HTTP API, and onramp
Environments	Sandbox and live	Live only
Where it can live	Your server only	Browser or server, once you limit its destinations
Copy it again	Sandbox only	Always, from the kit's page

Rotate or revoke a gateway key from its kit's Settings, or from API Keys like any other key. Rotating issues a new key, so the gateway key changes: deploy the new one before the grace period ends. See Gateway Kit security for the controls that bound what it can do.

Using the key

Send the key in the X-API-Key header to https://api.stridge.com. The prefix routes the request to the right environment, so sandbox and live use the same base URL. See Authentication in the API reference.

Was this page helpful?