API Keys

API keys are Plane B credentials and must stay server-side.

Create and rotate

Use the backoffice or the Plane B API:

• GET /internal/api-keys
• POST /internal/api-keys
• PATCH /internal/api-keys/{id}
• DELETE /internal/api-keys/{id}

Handling rules

• Store keys in Vault or a dedicated secret manager.
• Never put keys in mobile apps.
• Never commit keys to Git.
• Scope keys by environment.
• Rotate keys when an operator leaves, a CI system changes, or logs suggest exposure.

Playground use

The API reference supports X-Plug-Wallet-Api-Key in the Authorize dialog. Only use sandbox keys in a browser playground.