Authenticates checkout operations — creating and paying orders
Server, and safe to expose to your frontend if you must
Secret key
Authenticates money-moving and read-back operations — verification, refunds
Server only
RSA encryption key
Encrypts request payloads. Not an API key.
Server
Reeple doesn’t currently offer self-service key generation. To get your keys, contact Reeple
as part of onboarding.
Keys are issued as a matching set per environment. A test public key only works alongside the
test secret key and the test encryption key — don’t mix a test credential with a live one.
Sending the wrong kind of key returns 401 — Invalid public key passed or
401 — Invalid SECRET key. It is not a generic auth failure: the API is telling you the key
is valid but of the wrong type for that endpoint.
Your secret key can move and read back money. Keep it server-side only — never in client-side
code, mobile apps, or public repositories. Always call this API over HTTPS.
If you suspect a key has been compromised, contact Reeple immediately to have it rotated. Once
rotated, the old key stops working right away, so update your servers before requesting a
rotation.
Authenticating a request and encrypting its body are two different things. Most endpoints need
both — the api-key header and an RSA-encrypted data field.
Encryption
How to encrypt payloads, with working code in four languages.
