API keys
Credentials for the mobile app, aggregators and partners.
| Name | Key | Scopes | Created | Last used | Status | |
|---|---|---|---|---|---|---|
| Mobile app (production) | ev_live_8f2c… | sessions:writestations:readpayments:write | Mar 2026 | 2 min ago | active | |
| PayHere aggregator callback | ev_live_31ab… | webhooks:write | Mar 2026 | 11 min ago | active | |
| Partner sandbox - ChargeNET | ev_test_77de… | stations:read | Jun 2026 | Yesterday | active | |
| Legacy pilot key | ev_live_0a19… | stations:read | Feb 2026 | 3 weeks ago | revoked | - |
Rotation policy
Rotating is not revoking. A rotation issues a new key and keeps the old one valid for a grace period so the client can be updated without downtime. Revoking kills it instantly - use that when a key has leaked.
The mobile app key is embedded in a shipped binary. Treat it as public: anyone with the app can extract it. It is scoped to what a customer can already do, and every privileged action still requires the customer's own authenticated session on top.
Housekeeping
Test keys with real traffic are worth a second look - either the partner is testing against production data, or this key is misnamed. Both are worth knowing.
Revoked keys stay visible on purpose. Deleting the row would erase the evidence of what it could do and when it was last used - exactly what you need after an incident.