nipost_pk_test_… / nipost_pk_live_…) are API keys designed
to ship inside client-side code — web pages, mobile binaries — where anyone can
read them. They are safe to embed because they are tightly constrained:
Create one in the dashboard (Settings → API Keys → Publishable), listing
every web origin that will embed the widget, e.g.
https://checkout.acme.ng.
Native mobile apps send no Origin header, so the allowlist only gates
browsers.
Threat model
Anyone holding your publishable key can start widget sessions and, given a person’s NIN or email, list that person’s bookmark labels and postcodes. That exposure is bounded by design — minimal fields, anti-enumeration responses, rate limits, hashed-identifier audit logs, credit metering — but you should still:- keep separate test and live keys, and rotate if a key leaks beyond your app;
- never grant a publishable key more scopes or level than it needs;
- use a secret key server-side instead whenever a browser is not involved.