API credentials

A credential is a pair:

• a key id, pk_ followed by 24 hex characters. It identifies you and travels in the clear, in the X-OnLink-Key header.
• a secret, which signs your requests. It never travels — not in a header, not in a body, not in a query string. Anything that transmits it has leaked it.

We issue both. There is no self-serve key creation endpoint.

Storing the secret

Treat it as you would a private key:

• keep it in a secrets manager or an environment variable, never in source control and never in client-side code;
• never log it, and never log a signing string that could be replayed;
• give it to your server only. A browser or mobile app cannot hold this secret — anything shipped to a device is public.

If a secret is exposed, tell us immediately and we will rotate it. A leaked secret lets someone create orders as you.

Webhook secrets are separate

Your webhook signing secret is a different value from your API secret. One signs requests you send us; the other verifies deliveries we send you. Mixing them up produces a signature mismatch on whichever side you got wrong — see Verifying signatures.

IP allowlisting

A credential can optionally be restricted to a set of source addresses. An empty allowlist means unrestricted, which is the default. If you have stable egress addresses, tell us and we will set it — it is the cheapest extra control available on this API.

Rotation

Ask us and we issue a new pair. Deploy the new credentials, confirm traffic is signing with them, then tell us to retire the old pair.