Take your merchant API key

Take the merchant’s sk_ key from the Maxana dashboard and put it in production secret storage. Send it from trusted server code as Authorization: Bearer sk_live_....

This key resolves directly to its own merchant. Do not send X-Merchant-Id; that additional scope header is for a channel acting for one of its merchants. The exact credential alternatives for every operation are listed in the authentication reference.

Rotate a key by deploying the replacement before revoking the old one. Treat a key found in a browser bundle, URL, log, analytics event, or support screenshot as exposed and replace it.

Current limits

The merchant key has no safe browser use. It cannot be restricted to one checkout and must never be used by maxanapay.js, hosted checkout, embedded checkout, or any other buyer-side code.

Continue to Create a checkout session.