Skip to main content
All secret key requests must be authenticated. The key identifies the merchant and the environment (test or live). Use the Bearer scheme:
Requests without a valid secret key return 401 Unauthorized.

​
Key types

Copy your keys from the Demat dashboard after you create a merchant account. Keep the secret key in your server environment. Never put it in a browser or mobile app.

​
Test vs live

Use the same base URL for both. The secret key selects the data plane. A test key always uses sandbox data. A live key requires admin verification and live mode.

​
Protect the secret key

  • Do not put sk_ keys in frontend code, mobile apps, or git.
  • Store them in environment variables or a secrets manager.
  • Rotate a key immediately if you think it leaked.

​
SSL

Call the API over HTTPS. Do not disable TLS verification (VERIFY_PEER or equivalent) in production.