API Keys & Key Management
SolydFlow authenticates every client SDK request and backend API call using project-scoped API key pairs.
[1. Copy Key Pair from Console] ➔ [2. Embed Public Key in Client SDK] ➔ [3. Store Secret Key in Env Vars] ➔ [4. Zero-Downtime Rotation]
To eliminate cross-environment leakage, Sandbox and Live environments use completely distinct key pairs.
API Key Types & Permissions Matrix
| Key Name | Prefix | Target Environment | Where to Store | Permitted Actions |
|---|---|---|---|---|
| Test Public Key | sf_pk_test_... | Sandbox | Mobile Apps, Web Frontend | Fetch test offerings, start test checkouts. |
| Test Secret Key | sf_sk_test_... | Sandbox | Backend Server .env | Manage sandbox users, trigger test refunds. |
| Live Public Key | sf_pk_live_... | Production | Mobile Apps, Web Frontend | Fetch live offerings, initiate real checkouts. |
| Live Secret Key | sf_sk_live_... | Production | Backend Server .env | Administrative API calls, server-to-server intent creation. |
Protect Your Secret Keys
Never commit sf_sk_... keys to version control (Git) or embed them in compiled client apps (Flutter, React, iOS, Android). If a secret key is pushed to a public repository, revoke it immediately in the console.
Safe Key Placement in Practice
- Client Apps (Flutter / Web)
- Backend Servers (Node.js / Python)
lib/main.dart (Client Mobile SDK)
// Safe: Only Public Keys are shipped inside mobile binaries
await SolydFlow.configure(
apiKey: kReleaseMode
? "sf_pk_live_44019283bc918237fa"
: "sf_pk_test_a8f93b1c8e924a1b82",
userID: user.uid,
);
.env (Backend Environment File)
# Confidential: Kept on protected servers only
SOLYDFLOW_SECRET_KEY=sf_sk_live_1982736450192837465019283
SOLYDFLOW_WEBHOOK_SECRET=whsec_live_991823ab719284bc710293
Zero-Downtime Key Rotation (Rolling Grace Window)
When rotating a compromised or aging Secret Key:
- Log in to the SolydFlow Console and go to Project Settings → API Management.
- Click Regenerate Secret Key.
- SolydFlow generates a new key (
sf_sk_live_...new) while activating a 24-hour Rolling Grace Period. - Both the old key and the new key remain valid for 24 hours.
- Deploy your updated backend environment variables.
- Once deployed, click Decommission Old Key Now or allow it to expire automatically after 24 hours.
[Old Key Active] ➔ [Click Regenerate] ➔ [24-Hour Dual-Key Grace Window] ➔ [Deploy Backend] ➔ [Old Key Decommissioned]
This guarantees zero failed customer checkouts during infrastructure maintenance.
Emergency Revocation Protocol
If you suspect an API key has been compromised (e.g. accidentally pushed to GitHub):
- Go to Console → Project Settings → API Management.
- Click Emergency Revoke next to the compromised key.
- Select "Revoke Immediately (Zero Grace Period)".
- The key is instantly invalidated across all SolydFlow edge nodes (
401 Unauthorized). - Copy the newly generated key pair and update your production server environment variables immediately.