Live vs test keys
Every key is environment-scoped, and the prefix tells you which:| Prefix | Operates on | Use for |
|---|---|---|
rk_live_… | your live data — real subscribers, real charges | production |
rk_test_… | isolated test data — no real charges, no real emails | development + the docs “Try it” console |
A
rk_test_ key can never touch live data, and a rk_live_ key never touches
test data. Keep them straight in your config (e.g. RECURR_API_KEY per
environment).Getting + managing keys
Keys are created in your dashboard under Settings → API keys by a user with thedeveloper (or admin) role. When you create a key:
- The secret is shown once — store it immediately in your secrets manager. Recurr stores only a hash; we can’t show it again.
- Each key carries a scope (read-only vs read-write) so you can issue a least-privilege key per integration.
- Keys are listed by prefix + last-four + creation date for identification.
Rotation + revocation
- Rotate by creating a new key, deploying it, then revoking the old one — both work during the overlap, so there’s no downtime.
- Revoke immediately if a key is exposed; revocation takes effect at once.
- Keys auto-revoke when the issuing member is removed or the account is offboarded.
Keeping keys safe
- Store keys in a secrets manager, not source control.
- Use a separate key per environment + per integration.
- Prefer a read-only key for anything that only reads.
- Rotate on a schedule and after any suspected exposure.
Errors
A missing, malformed, revoked, or wrong-environment key returns401: