Verified BursaPay workflow: Explain how developer API keys are stored and which key material must never be exposed.
1. Overview & Purpose
DeveloperApiKey stores key prefixes and hashes; only test secret-key plaintext may be retained in encrypted form for the sandbox proxy.
2. Requirements & Setup
Keep secret keys on a server-side secrets manager and limit live-key access.
3. Step-by-Step Workflow
- Create a key in the developer portal.
- Copy the secret value at creation time.
- Store it in your application's secret store.
- Use only the masked prefix for logs or support references.
4. Rules & Troubleshooting
Live secret-key plaintext must never be persisted by application code. Never put secret keys into frontend bundles, screenshots or logs.
5. Verification & Next Steps
Rotate compromised keys immediately and review recent API logs afterward.