# API keys

You can authenticate your calls to the [Checkout.com API](https://api-reference.checkout.com/) using public and secret API keys.

---

## Public API keys

Public API keys are used for client-side authentication.
They can only access a limited set of our APIs, mostly those you call as part of your payment environment.

You use public keys when tokenizing card information through [Flow](https://www.checkout.com/docs/payments/store-and-manage-credentials/tokenize-credentials.md) or for [Google Pay](https://www.checkout.com/docs/payments/add-payment-methods/google-pay.md), and in our [mobile SDKs](https://www.checkout.com/docs/developer-resources/sdks.md) and [integrated partner platforms](https://www.checkout.com/docs/payments/accept-payments/connect-to-our-integration-partners.md).

---

## Secret API keys

Secret API keys are used for server-to-server authentication.
They can access most of our APIs.

> **Information**
>
> If you want to use key authentication for an endpoint where this is not specified in the API reference, [request support](https://dashboard.checkout.com/support/new?topic=case_account_management_and_access&issue=issue_account_changes).

You can configure your secret API keys in one of the following ways:

- A single key that can access all APIs you want to use
- Multiple keys, each of which can access a specific set of APIs you want to use

### Multiple keys example

You may need to use multiple keys if you have separate systems for processing payments and managing disputes that have different security requirements.
You do not want the disputes management system to access sensitive payment processing information.

To keep the systems separate, you can use one secret key for the Payments API, and a second secret key exclusively for the Disputes API.

> **Note**
>
> Always store your secret API keys securely, because you can use them to perform sensitive actions through the API. Any exposure of these keys puts your account security at risk.

---

## Manage API keys in the Dashboard

To manage your keys in the Dashboard, you need one of the following [user roles](https://www.checkout.com/docs/business-operations/use-the-dashboard/manage-users/user-permissions.md):

- Admin
- Developer
- A custom role with the `Create new keys` or `View the list of keys` permission

> **Note**
>
> Only users with the Account owner role can edit or delete existing keys.

1. Sign in to the [Dashboard](https://dashboard.checkout.com).
2. Select _Developers_ in the left navigation bar and open the _Keys_ tab.

From here, you can:

- View all keys for your account.
- Create new keys.
- Edit existing keys, including scope updates for public API keys only.
- Delete existing keys.

> **Information**
>
> - If you're using an ecommerce platform, assign only one processing channel to your public and secret API keys.
> - For more information, see [Developers](https://www.checkout.com/docs/business-operations/use-the-dashboard/developers.md).

---

## Authenticate using API keys

To use an API key in your API request, provide it in the `Authorization` header with the `Bearer` Prefix.

### Request example

```bash
curl --location --request POST 'https://{prefix}.api.sandbox.checkout.com/payments/' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer sk_sbox_wjvrysklsqjmrhn3yoexnshsl72' \
--data-raw '{
  "source": {
    "type": "card",
    "number": "4242424242424242",
    "expiry_month": 12,
    "expiry_year": 2025
  },
  "amount": 100,
  "currency": "EUR",
  "reference": "ORD-175-759"
}'
```