Credentials
Plurel Pay issues several different secrets. They are not interchangeable. A typical browser storefront uses a publishable key plus a signing secret — not the secret API key.
Copy this page as a setup prompt for your coding assistant.
At a glance
| Credential | Prefix | Storefront checkout | Headless REST | Typical env var |
|---|---|---|---|---|
| Merchant ID | plurel_merch_ | Yes — identifies your account in API calls | Yes | NEXT_PUBLIC_PLUREL_MERCHANT_ID |
| Publishable key | plurel_pk_test_ / plurel_pk_live_ | Yes — browser SDK and signed session create | Optional — server can use publishable + signature instead | NEXT_PUBLIC_PLUREL_PUBLISHABLE_KEY |
| Signing secret | plurel_sign_ | Yes — server HMAC for cart signatures (required with publishable key) | No — not used when secret key skips signing | PLUREL_SIGNING_SECRET |
| Secret API key | plurel_sk_test_ / plurel_sk_live_ | No — never in the browser | Yes — server automation, webhook admin, unsigned session create (when approved) | PLUREL_SECRET_KEY |
| Webhook secret | whsec_ | Optional but recommended — verify dashboard webhook deliveries | Same | PLUREL_WEBHOOK_SECRET |
The common mistake
Signing secret ≠ secret API key ≠ webhook secret. PLUREL_SIGNING_SECRET (plurel_sign_…) signs carts for the browser SDK. PLUREL_SECRET_KEY (plurel_sk_…) is a REST bearer token for backend-only calls. PLUREL_WEBHOOK_SECRET (whsec_…) verifies inbound webhook deliveries only. Putting the wrong credential in your signing env var produces Invalid cart signature — even when the value is valid for another purpose.
What each integration uses
Hosted modal (CDN or npm) — most storefronts
This is the default path: shopper clicks Split with Plurel, your server signs the cart, the SDK opens the modal on plurelpay.com.
| Step | Credential |
|---|---|
| Browser loads SDK | Publishable key + merchant ID |
| Shopper clicks Split with Plurel → your POST /api/cart/sign | Signing secret (server only) |
| SDK calls POST /api/v1/sessions | Publishable key + X-Plurel-Signature header (X-Plurel-Signature accepted) |
| You fulfill the order | Webhook secret (whsec_…) on POST /api/webhooks/plurel |
Secret API key is not used. See Getting started, JavaScript SDK, and Cart signing.
React storefront
Same credentials as the hosted modal path. @plurel/react-sdk is a thin wrapper around @plurel/sdk — it does not change which keys you need.
Headless REST (server-owned checkout)
Your backend calls POST /api/v1/sessions with a secret API key. When headless_api_enabled is true on your merchant, cart signing can be skipped. No browser SDK, no publishable key, no signing route — but also no hosted button; you build the UX yourself.
Request access from Developers → Headless REST (owners and admins). Our team reviews your use case and enables headless_api_enabled in Support Console. See the REST API docs.
Environment variables (copy-paste)
# Client — safe to expose in the browser bundle NEXT_PUBLIC_PLUREL_MERCHANT_ID=plurel_merch_… NEXT_PUBLIC_PLUREL_PUBLISHABLE_KEY=plurel_pk_test_… # Server only — never prefix with NEXT_PUBLIC_ PLUREL_SIGNING_SECRET=plurel_sign_… PLUREL_WEBHOOK_SECRET=whsec_… # optional until you wire webhooks # NOT needed for browser checkout: # PLUREL_SECRET_KEY=plurel_sk_test_…
Older names
Older integrations may still use ante.js, window.Ante, ante_* keys, ANTE_* environment variables, and webhook field fx_fee_ante_bps. Those names still work. New integrations use plurel.js, window.Plurel, plurel_* keys, and PLUREL_* environment variables.
Where to get each value
| Credential | Dashboard location |
|---|---|
| Merchant ID | Business menu or Settings |
| Publishable + secret API keys | Developers → API keys (shown once at create or rotate) |
| Signing secret | Developers → Signing (generate or reveal) |
| Webhook secret | Webhooks → add endpoint → whsec_ shown once |
Open the prefilled wizard at Developers for snippets with your merchant ID filled in.
Test vs live
Sandbox keys are plurel_pk_test_* and plurel_sk_test_*. Activate live issues plurel_pk_live_* and plurel_sk_live_* (shown once). Sandbox keys stay valid in the sandbox view. The signing secret is per merchant (not per key prefix) — rotate it on Developers if you suspect a leak; then update PLUREL_SIGNING_SECRET everywhere and redeploy.
Related
Security · Cart signing · Troubleshooting · the sandbox demo store · Demo store source