Secrets & config

How to store Seller API credentials, separate sandbox from production, and rotate keys without downtime.

Secret storage, environment variables, webhook secrets, and a zero-downtime rotation sequence. Complements Authentication and Security.

Avrix shows the raw API key once at creation. Store it immediately in your secret manager; you cannot retrieve the plaintext later.

Sandbox and production share the same host. The key selects the environment.

• Sandbox keys see the shared sandbox catalog and magic SKUs.
• Production keys see only your live commercial catalog.
• Mixing a production key with sandbox expectations (or the reverse) fails with environment mismatch errors — see Environments.

Inject different secret values per deploy stage (development, pre-production, production). Never paste a production key into a shared chat or CI log.

Load secrets at process start; fail fast if the key is missing.

# Prefer env vars — never hardcode secrets in source control
export AVRIX_API_KEY="avrix_sk_sbx_your_key_here"
export AVRIX_BASE_URL="https://api.avrix.io"

Both the old and new keys remain valid until you revoke the old one.

1. Create a second key with the same scopes and environment.
2. Copy optional IP allowlist entries onto the new key.
3. Deploy the new AVRIX_API_KEY to your pre-production stack first.
4. Verify with GET /whoami, a catalog read, and a dry-run preview.
5. Revoke the old key after traffic moves off it.

Webhook secrets rotate the same way: register the new secret with overlap, verify signatures against either secret during the window, then drop the old one.

Mint keys with only the scopes your integration needs. A catalog-sync worker does not need refund write scopes. Confirm effective scopes on GET /whoami after every create or rotate — see Scope matrix.

• Never log the full API key or webhook secret.
• Prefer requestId, key id (if shown in console), and orderReference in support tickets.
• Redact Authorization headers from HTTP debug dumps in non-production.

• Committing .env files that contain live keys.
• Rotating by deleting the only key before the deploy finishes.
• Using one key for both sandbox experiments and production traffic.
• Sharing a production key in a group chat “just for a quick test”.

• Authentication — scopes and key lifecycle
• IP allowlist — optional egress restrictions
• Go-live — production cutover