ReBate Pay DocsAPI Keys & Security
The difference between test and live keys, the full scope list, and how to handle keys safely.
Test keys vs. live keys
The key prefix identifies its environment: rbp_test_... is a test key (the only kind currently issued), rbp_live_... is a live key (not yet issued). A test key is rejected in Production, and a live key is rejected in Sandbox — there's no way to accidentally cross environments.
One-time reveal, revoke, rotate
- The full secret is shown only once, at creation time; every later
GETreturns just the prefix. - You can revoke at any time — takes effect immediately, every subsequent request with that key is rejected.
- You can rotate: create a new key, cut your service over, then revoke the old one, with an overlap window so nothing breaks.
- The dashboard shows a key's creation time and last-used time, so you can spot keys that were created but never used.
Full scope list
Write (:write) always implies read (:read). Only check the scopes a key actually needs. Scopes marked "high-risk" move real money — authorize them extra carefully.
| Scope | Grants |
|---|---|
products:read / products:write | Product catalog |
prices:read / prices:write | Prices |
customers:read / customers:write | Customer data and payment method refs |
subscriptions:read / subscriptions:write | Subscription create/read/cancel |
billing:read | Billing records |
payments:read / payments:write | Payment read / high-risk: create or attempt a charge |
refunds:read / refunds:write | High-risk: refunds |
payment_links:read / payment_links:write | Payment Links |
webhooks:read / webhooks:write | Webhook endpoints and event/delivery logs |
usage:read / usage:write | Usage meters and Credits (non-cash) |
entitlements:read / entitlements:write | Feature entitlement checks |
discounts:read / discounts:write | Promotion codes |
mcp:invoke | Call MCP tools — see MCP / AI Integration |
ai:invoke | Call the AI conversation endpoints |
analytics:read | Workspace analytics |
logs:read | Audit logs |
payouts:* | Planned — currently always returns 403 SCOPE_DISABLED, not yet available |
What you must never do
- Keys belong in server-side environment variables only — never in frontend code or a browser network request.
- Never log the full key, card number/CVV, or a Customer Portal token in your own logs.
- A request missing a scope gets
403 SCOPE_DENIED; requesting a not-yet-available scope likepayouts:*gets403 SCOPE_DISABLED.