A live Paystack secret key lets whoever holds it call the Paystack API as your business: reading transactions and customer details, creating charges and payment links, refunding payments and, depending on your account settings, initiating transfers to bank accounts. That makes it one of the most damaging keys to leak, and the fix is quick. Regenerate the key first, then read what happened on the account.
Check your GitHub account for leaked secrets — free
- Provider
- Paystack
- Severity
- Critical
- Impact
- Payments and customer data
- Checked live by LeakWatch
- No
What a Paystack secret key looks like
A Paystack secret key starts with sk_, then a mode word, then a second underscore and 40 letters and digits:
sk_live_…XXXX secret key, live mode → real money. Treat a leak as an incident.
sk_test_…XXXX secret key, test mode → no real money, but still replace it.
pk_live_…XXXX public key → meant to be embedded in client code.
The public key (pk_) is designed to appear in a web page or app and is not a leak by itself. The secret key must stay on your server. The look of the secret key is close to a Stripe one, since both begin sk_live_ or sk_test_, but Stripe bodies differ in length, and the pattern described below requires exactly 40 characters after the mode word. The variable name is usually PAYSTACK_SECRET_KEY, and a call to api.paystack.co is a good hint.
How Paystack secret keys get leaked
- Hardcoded in server code during integration and never moved to an environment variable.
- The wrong key in the front end. The secret key was used where the public one belongs, so it shipped inside a JavaScript bundle or a mobile app.
- Checkout plugins. A store plugin or theme configuration that holds both keys, exported or committed with the site.
- Webhook and cron scripts run on a server and committed along with their configuration.
- Documentation and support. A curl example with
Authorization: Bearer sk_live_…in a README, a Postman collection, a ticket or a screenshot.
What to do in the first hour
- Open the API keys page of the Paystack Dashboard (see the link below), under the settings area for API keys and webhooks. Test and live keys are shown separately, so make sure you are on the right mode.
- Regenerate the exposed key. Generating a new secret key replaces the old one. Because the key is compromised, make sure the old value stops working at once rather than after any grace period the dashboard may offer.
- Deploy the new key to your servers, and check that a test payment goes through. Store it in an environment variable or secret manager.
- Review transactions. Look at the transaction list for the period since the exposure: payments, refunds and charges you do not recognize.
- Review transfers and recipients. Check transfer recipients and any payouts. A newly added recipient followed by a transfer is the pattern to look for. If transfers need an approval step or a PIN, confirm that this is enabled.
- Review webhooks and settings. Make sure the webhook and callback URLs are yours, and that no settings or team members changed. Check the list of dashboard users.
- Assess customer data. If the logs suggest customers’ details were read, you may have notification duties. Talk to Paystack support and a qualified adviser. Then clean the repository; see I accidentally pushed an API key to GitHub.
Not sure what else leaked from the same repository? Run a free scan.
Revoke it at Paystack
Paystack secret keys are managed from the API keys and webhooks page of your Paystack Dashboard, after you sign in as an owner or an administrator. Regenerate the exposed key so that the old value is retired. Paystack’s developer documentation describes the key types and how to keep them safe. A person has not confirmed the exact menu wording for this guide, and dashboards change, so if what you see differs from this description, look for the page where keys and webhook URLs are listed, and check Paystack’s documentation.
How LeakWatch detects it
The rule is called Paystack Secret Key. It recognizes sk_ followed by a word of lowercase letters (such as live or test), an underscore and exactly 40 letters and digits, with word boundaries on both sides. It does not need a variable name next to the value. Public keys (pk_), and strings with a different length, are not reported. The severity is critical, because the key can move money and read customer data. This type is not checked live: LeakWatch does not send any request to Paystack with the key it found.
LeakWatch detects this format but does not check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it.
FAQ
Is a leaked pk_live_ public key dangerous?
Not on its own. Public keys are meant to be embedded in client code. What matters is that the secret key did not leak next to it.
My leaked key was a test key. Do I still need to act?
The urgency is lower, because test mode cannot touch real money. Regenerate it anyway: it exposes your test data and setup, and it suggests the same habit may have leaked a live key.
How can I tell whether someone used the key?
Review transactions, refunds, transfers and webhook settings for activity you did not cause, and contact Paystack support right away if you find some.