Skip to content
Allidian

Managing API keys

Create, restrict, rotate and revoke keys safely.

API keys authenticate your server's requests. Each key belongs to one environment.

  • Secret keys (al_sk_test_… / al_sk_live_…) have full access. Keep them on your server.
  • Restricted keys can be limited to specific scopes, such as read-only payments.
  • Publishable keys are safe to use in browsers for client-side features.

Secret keys are shown only once when created; we store a hash, so we can't show them again. If you lose one, create a new key and revoke the old one.

curl "https://api.allidian.com/v1/payments" \
  -H "Authorization: Bearer al_sk_test_..."