Skip to content
Biz Invoice Pay.Docs

API keys

Create, copy once, and revoke Biz Invoice Pay API keys. Test vs live keys, and why you never need a Stripe secret key.

API keys

API keys let your website or systems talk to Biz Invoice Pay's API. Create them in Settings → API keys (owner role only).

Create a key

  1. Click Create key and give it a name ("Website checkout", "WooCommerce").
  2. Choose the mode: test or live.
  3. The full key is shown once. Copy it now — after you leave the page, only the prefix (e.g. inv_test_9f3a…) is visible. If you lose it, revoke and create a new one.

Keys look like inv_test_9f3a2b1c… (32 random hex characters) or inv_live_….

Test vs live

  • Test keys (inv_test_…) work only in test/mock mode. Use them while building. Payments use test cards; nothing real moves.
  • Live keys (inv_live_…) work only after Stripe onboarding is enabled on a live account. Treat them like cash.

Revoke a key

Click Revoke next to a key. Revocation is immediate: in-flight retries with that key start failing, so rotate on your server first, then revoke the old key. There's no "un-revoke" — revocation is final.

Storage rules

  • Store keys as environment variables on your server (e.g. INVOICLY_API_KEY), never in client-side JavaScript, mobile apps, or git.
  • If a key leaks (pasted in chat, committed to a public repo), revoke it immediately and rotate.

Never use or share a Stripe secret key with Biz Invoice Pay. You don't need one — you only need the Biz Invoice Pay API key. Stripe credentials are exchanged during onboarding, handled by Stripe itself, and never stored by Biz Invoice Pay. If anyone asks for your Stripe secret key, don't share it with anyone.

Scopes and least privilege

Every key acts as your business. Name keys by purpose and keep one per integration so you can revoke a single system without breaking the others. Keys inherit owner-level API access — there are no per-key scopes yet, so protect them accordingly.

Last updated: October 14, 2026

Was this page helpful?