Keys and Credentials

Super issues several credentials, and which ones you need depends on how you integrate. This page lists all of them in one place.

Credential	Prefix	Used for	Where to find it	Keep secret
Super key	`sk_prod_` `sk_test_`	Authenticating server-side API requests.	Developers → API Keys → Super Keys	Yes
Publishable key	`PUB_`	Front-end integrations.	Developers → API Keys → Publishable API Keys	No
Confirmation ID	`PWH_`	Telling your e-commerce platform that transactions from Super are legitimate.	Developers → Integrations → View integration details	Yes
Plugin API key	`PSK_`	Letting your plugin send payment details to Super.	Developers → Integrations → View integration details	Yes
Webhook signing key	`whsk_`	Verifying that a webhook came from Super and has not been tampered with.	Developers → Webhooks → select a webhook → Signing keys	Yes
Checkout session token	–	Initialising the embedded checkout component in the browser.	Returned by `POST /checkout-sessions`	No
Brand ID	–	Identifying which brand a payment, payment link or customer belongs to.	Developers → API Keys → Brand payment initiators and IDs	No
Payment initiator ID	–	Required in the request body when creating payments via the API.	Developers → API Keys → Brand payment initiators and IDs	No

Which credentials do I need?

Building a custom API integration

You are calling the Super API directly from your own server and checkout.

Super key, Publishable key, Brand ID and Payment initiator ID. Add a Checkout session token per payment if you are using the embedded component.

Installing an e-commerce plugin

You are using one of Super's plugins for Shopify, WooCommerce, Magento or BigCommerce.

Confirmation ID and Plugin API key. These belong to the integration rather than your account, so each store you connect has its own pair.

Third party integration

You are connecting Super to a platform we do not provide a plugin for, where that platform calls our API on your behalf.

Super key, Confirmation ID, Webhook signing key, Brand ID and Payment initiator ID.

Receiving webhooks

Any of the above can receive webhooks. Each endpoint you create has its own Webhook signing key, used to verify the request came from Super.

Things worth knowing

⚠️
The plugin API key is shown once
Your PSK_ key is displayed only at the moment you generate it. Copy it straight into your e-commerce platform before generating another. Your Confirmation ID stays the same for the life of the integration.

📘
Keys are issued per API version
Super keys and publishable keys are tied to an API version. Use the API version selector on the API Keys page to see the keys for the version you are integrating against. If you move to a newer version, generate new keys for it.

📘
Test credentials are separate
Your sandbox uses its own credentials - a Super key starting sk_test_ and separate integration keys. A live key will not work in the sandbox, and the reverse is also true. See Sandbox Environment.

Next steps

Authentication - how to pass your Super key in a request, and how to create and rotate keys.
Webhooks - registering an endpoint and verifying signatures with your signing key.
Integration Security Guide - how to store and protect these credentials.
Users and Roles - who on your team can see and create keys.