Authentication

Use the credential that matches where your code runs.

kepa has three credentials. They are not interchangeable.

Your serverX-Api-KeySecret key for online payments, refunds, saved cards, and account-level API calls.

Android terminalAuthorization: BearerDevice token provisioned to one payment terminal. Use only for /api/v1/terminal/*.

Customer browserPublishable keyPublic key used by kepa.js. It cannot authorize a charge by itself.

Server secret key

Store this key in your server-side secret manager. Never ship it in JavaScript, a mobile app, logs, analytics, or a URL.

curl https://api.kepapay.co/v1/cnp/payment-intents/pi_123?merchantId=mch_123 \
  -H "X-Api-Key: $KEPA_SECRET_KEY"

Terminal device token

The terminal receives this token during provisioning. Keep it inside the secure Android terminal process. A POS, merchant backend, or browser should never use it.

curl https://api.kepapay.co/api/v1/terminal/vas-config \
  -H "Authorization: Bearer $KEPA_DEVICE_TOKEN"

Browser publishable key

The publishable key is designed to appear in page source. Browser checkout still requires a short-lived client secret created by your server, and requests are restricted to the origins configured for the key.

const kepa = Kepa("pk_kepa_...");
// Publishable keys may be included in browser code.
// Never put KEPA_SECRET_KEY or KEPA_DEVICE_TOKEN here.

If a credential leaks

Stop using it, revoke or rotate it in the dashboard, and deploy the replacement. Do not paste credentials into support tickets or error reports.

Next: take an in-person payment, build online checkout, or learn about safe retries.