How to Secure Your Recharge API Key

An API key on a recharge account is a key to money. Someone with it can drain your balance in minutes. Here is what actually protects it.

IP whitelisting does most of the work

A key that only works from addresses you list is nearly useless to anyone who steals it. Add every server that will call the API — production, staging, any cron box — and nothing else.

Two practical notes. Add the outbound IP of your server, which on some hosts differs from the address your site answers on. And if you are behind Cloudflare, the address that matters is your origin server's, not Cloudflare's.

Where keys actually leak

• Committed to Git. The most common by far. Once pushed to a public repository, assume it is compromised — scanners find them within minutes.
• In front-end code. Anything in JavaScript that reaches the browser is public. Recharge calls belong on your server.
• In a screenshot. People paste dashboard screenshots into support chats without blurring.
• In a shared .env sent over WhatsApp. That file outlives the conversation.

Keep it out of source control

# .env — never committed
RECHARGE_API_KEY=xxxxxxxx
RECHARGE_API_USER=01XXXXXXXXX

# .gitignore
.env

If a key has already been committed, rotating it is the only fix. Deleting the file does not help — it remains in the history.

Verify webhook signatures

Protecting outbound calls is half the job. If you accept webhooks, an unverified endpoint lets anyone POST a fake success. Compute HMAC-SHA256 over the raw body with your secret and compare with hash_equals.

Rotate on a schedule

Every few months, and immediately when a developer leaves, a laptop is lost, or you see a request you cannot explain. Rotation is a minute of work and it closes off leaks you never discovered.

Watch your own logs

Check weekly for requests outside business hours, unusual amounts, and repeated failures from one address. A key being tested by someone else usually shows up as a burst of rejections before any successful call.

Separate keys for separate systems

If your shop app and your website both call the API, give them different accounts where you can. When one is compromised you disable it without stopping everything.