Authentication - Recurr

API access is scoped during pilot onboarding. Where a customer needs event delivery, exports, or API access, Recurr provisions credentials for the agreed environment and scope.

Key handling

Treat Recurr API keys as secrets
Store keys server-side only
Use separate keys for test and production where available
Rotate keys if exposed
Do not embed keys in mobile apps, websites, or public repositories

Environment separation

Test and production credentials should not be mixed. Test mode is used to validate payloads, destinations, authentication, and replay behavior without affecting live subscriber state.

Destination authentication

For outgoing webhooks, Recurr signs event payloads where configured so the customer’s endpoint can verify that events came from Recurr. The exact signing mechanism and header names are confirmed during onboarding for the customer’s integration shape.