Skip to main content
GET
Read your pk_live_* publishable key — the one that powers embeddable Payment/Donation widgets. This endpoint takes no parameters — the merchant is inferred from your dashboard session.
This key is safe to embed in client-side code. It can only create widget payments — gated by each widget’s origin allowlist and rate limits — and reads nothing.

Authorization

This endpoint is dashboard-only: a dashboard JWT with role merchant_admin, merchant_member (with team permission widgets:view) or super_admin. API-key callers are rejected with 401 {"error":"Invalid or expired token"} — the JWT guard runs first and an API key is not a session token, so the call never reaches the role check. The key is not revoked; it simply cannot authenticate a dashboard-only route.
A super_admin passes the role guard, but platform accounts carry no merchant context, so the handler short-circuits with 400 {"ok":false,"error":{"code":"NO_MERCHANT_CONTEXT","message":"No merchant context"}}. In practice this endpoint is for merchant accounts.

Response fields

string
The full pk_live_* value, repeatable — it is not secret.

See also