API Key vs Publishable Key

Lydian issues two types of credential for API access: a Publishable Key and an API Key. They differ in where they are designed to be used and what they are allowed to do. Both are generated in the Merchant Portal — the pk_ and ak_ prefixes identify the credential type; they are not values you choose.

Publishable Key

  • Prefix: pk_
  • Header: X-Publishable-Key
  • Designed for: client-side, customer-facing payment integrations.
  • Used to: create a Session or Transaction, and read merchant configuration.
  • Merchant context: encoded in the key — append :{EXTERNAL_MID} to target a sub-merchant.

The publishable key is the credential your checkout uses to start a payment.

API Key

  • Prefix: ak_
  • Header: X-Api-Key
  • Designed for: server-to-server calls only — keep it secret and never expose it in client code.
  • Used to: perform privileged account and merchant operations, including accounts, merchants, key management, refunds, reporting, webhooks, and subscriptions.
  • Merchant context: pass the merchant in the X-MID header when an operation applies to a specific merchant.

Choosing between them

Use the publishable key in code that runs in the customer's browser or on your frontend, and the API key only from your backend. Because the publishable key is designed for client-side use, it is scoped to the payment-creation operations above rather than privileged account management — reach for the API key when an operation manages your account, merchants, refunds, reporting, or webhooks.