Test and live keys¶
| Prefix | Mode | Use |
|---|---|---|
sk_test_ |
Sandbox | Development and CI. No real money. |
sk_live_ |
Live | Production. |
| Webhook secret | Either | Signs the webhooks Oura sends you. Copy it from the dashboard. |
cs_ |
Either | Per-payment client secret, safe to use in the browser. |
Rules¶
- Secret keys stay on your server. Never put an
sk_key in a browser, mobile app or repository. The frontend SDKs throw an error if you pass one by mistake. - Modes never mix. A test key can't see live data and a live key can't see test data. The API enforces this on every request.
- Keep keys in environment variables or a secrets manager, never in source control.
- The client secret is only returned in full when the payment is created. Later reads show
cs_***.