Keys and Credentials

Every key, ID and token Super issues, what each one is for, and where to find it in the Business Portal.

Super issues several credentials, and which ones you need depends on how you integrate. This page lists all of them in one place.

Credential
Prefix
Used for
Where to find it
Keep secret
Super key
sk_prod_
sk_test_
Authenticating server-side API requests.
Developers → API Keys → Super Keys
Yes
Publishable key
PUB_
Front-end integrations.
Developers → API Keys → Publishable API Keys
No
Confirmation ID
PWH_
Telling your e-commerce platform that transactions from Super are legitimate.
Developers → Integrations → View integration details
Yes
Plugin API key
PSK_
Letting your plugin send payment details to Super.
Developers → Integrations → View integration details
Yes
Webhook signing key
whsk_
Verifying that a webhook came from Super and has not been tampered with.
Developers → Webhooks → select a webhook → Signing keys
Yes
Checkout session token
–
Initialising the embedded checkout component in the browser.
Returned by POST /checkout-sessions
No
Brand ID
–
Identifying which brand a payment, payment link or customer belongs to.
Developers → API Keys → Brand payment initiators and IDs
No
Payment initiator ID
–
Required in the request body when creating payments via the API.
Developers → API Keys → Brand payment initiators and IDs
No

Which Credentials Do I Need?

Custom API integration You are calling the Super API directly from your own server and checkout.
  • Super key
  • Publishable key
  • Brand ID
  • Payment initiator ID
  • Checkout session token, per payment, if using the embedded component
E-commerce plugin You are using one of Super's plugins for Shopify, WooCommerce, Magento or BigCommerce.
  • Confirmation ID
  • Plugin API key
These belong to the integration rather than your account, so each store you connect has its own pair.
Third party integration You are connecting Super to a platform we do not provide a plugin for, where that platform calls our API on your behalf.
  • Super key
  • Confirmation ID
  • Webhook signing key
  • Brand ID
  • Payment initiator ID

Any of these can receive webhooks. Each endpoint you create has its own Webhook signing key, used to verify the request came from Super.


Creating a Brand

A brand is the identity your customers see at checkout, and it carries its own payment methods and cash reward settings. Every Brand ID and payment initiator ID belongs to a brand, so create your brand before you go looking for those.

Brands live in the Business Portal under Settings → Brand settings, which lists your existing brands with their cash reward, expiry and last updated date.

Step 1: Brand Details

Select Add a new brand, then fill in:

Field
What to enter
Required
Brand name
The name your customers recognise. Leave off legal suffixes such as "Ltd" - this is the name shown at checkout.
Yes
Brand website
The store URL this brand trades under.
Yes
Brand category
Your merchant category, chosen from a list grouped by industry. This sets the brand's MCC, which determines how card networks classify your payments.
Yes

A preview panel on the right shows what a payment on your store would look like as you type.

Select Next - Cash reward to continue.

Step 2: Cash Reward

A cash reward is optional. To run the brand without one, select Enter a custom amount and set it to 0%.

To offer a reward, choose 2%, 4%, 5%, 6% or 8%, or enter your own percentage as a custom amount. 5% is marked Most popular.

Set Expiration to choose how long a reward stays usable, from 1 to 12 months.

📘

Changing a brand later

Select Edit beside any brand on the Brand settings page. The same two steps appear as Brand details and Cash reward tabs - change what you need and select Save changes.


Creating a Super Key

  1. Log in to the Business Portal and select Developers in the sidebar.
  2. Open the API Keys tab.
  3. Choose the version you are integrating against from the API version selector.
  4. Next to Super Keys, select Show.
  5. Select Add Super Key and store the new key securely.

Your publishable key is listed under Publishable API Keys - select Show to reveal it, then use the copy button. There is a single publishable key per API version, so there is nothing to create.

📘

Moving to a new API version

If you are using API version 2025-06-01 or later, API keys are managed per API version. Existing keys from an earlier version do not carry over - generate new ones for the version you are moving to.


Finding Your Brand ID and Payment Initiator ID

Your payment initiator ID is passed in the request body when you create a payment. Your Brand ID is required when creating payment links via the API. Both are listed in the same panel.

  1. Log in to the Business Portal and select Developers in the sidebar.
  2. Open the API Keys tab and scroll to Brand payment initiators and IDs.
  3. Select Show next to the brand you want.

Your Brand ID is shown at the top of the panel. Beneath it, a payment initiator ID is listed for each integration on that brand, shown under the integration's website URL.

If no payment initiator ID is listed, the brand has no custom integration yet. Create one under Developers → Integrations → Create new integration.

📘

Plugin integrations are not listed here

For API versions 2025-06-01 and newer, only custom integration payment initiator IDs appear in this panel. Integrations created by our e-commerce plugins are managed by the plugin and use a Confirmation ID and API key instead.


Things Worth Knowing


The plugin API key is shown once

Your PSK_ key is displayed only at the moment you generate it. Copy it straight into your e-commerce platform before generating another. Your Confirmation ID stays the same for the life of the integration.

Keys are issued per API version

Super keys and publishable keys are tied to an API version. Use the API version selector on the API Keys page to see the keys for the version you are integrating against. See Authentication.

Test credentials are separate

Your sandbox uses its own credentials, and a live key will not work in the sandbox. See Sandbox Environment.


Next Steps


Did this page help you?