API Keys Guide

Overview

Your API Credentials

Padiepal issues two keys per merchant account. Both are required to accept payments through your WooCommerce store.

API Key `pk_live_...`

Used to identify your merchant account when creating payment sessions. Sent as the X-API-Key header with every request.

Safe to use in plugin settings

Secret Key `sk_live_...`

Used to verify that incoming payment webhooks are genuinely from Padiepal. Your plugin checks the X-Padiepal-Signature header using this key.

Never share or expose publicly

Step 1

Log in to Your Padiepal Merchant Dashboard

Visit padiepal.com and sign in to your merchant account.

1

Go to padiepal.com

Open your browser and navigate to padiepal.com. Click Sign In in the top-right corner.

2

Enter your credentials

Log in with your registered email address and password. If you don't have an account yet, click Register to create one.

3

Go to the Merchant Dashboard

After logging in, click your profile icon → Merchant Dashboard, or navigate directly to padiepal.com/merchant/dashboard.

Step 2

Generate Your API Keys

API keys are generated from the Developers section inside your Merchants area.

1

Go to Merchants → Developers

In the top navigation, click Merchants, then select Developers — or go directly to padiepal.com/user/developers.

2

Click "Generate Keys"

If no keys exist yet, click the Generate API Keys button. A new API Key and Secret Key will be created instantly.

⚠ If keys already exist, generating new ones will invalidate the old keys immediately.

3

Copy both keys immediately

The Secret Key is shown only once. Copy it now and store it somewhere safe (e.g. a password manager). You will not be able to view it again after leaving this page.

padiepal.com/user/developers

Dashboard Transactions Developers Profile

Your API Credentials

API Key pk_live_xxxxxxxxxxxxxxxxxxxx

Secret Key sk_live_xxxxxxxxxxxxxxxxxxxx

Important

Your Secret Key is displayed only once at generation time. If you lose it, you must regenerate your keys — which will break any existing integrations until updated.

Step 3

Add Keys to the WooCommerce Plugin

Paste your keys into the Padiepal gateway settings inside your WordPress admin.

1

Go to WooCommerce → Settings → Payments

In your WordPress admin sidebar click WooCommerce → Settings, then select the Payments tab.

2

Click "Manage" next to Padiepal

Find the Padiepal row in the payment methods list and click the Manage button on the right.

3

Fill in all four fields and save

Enter the API URL, API Key, and Secret Key from your Padiepal dashboard, then click Save changes.

WooCommerce → Settings → Payments → Padiepal

API URL

Base URL of your Padiepal Merchant API — e.g. https://platface.com

API Key

Your Padiepal API Key (starts with pk_live_).

Secret Key

Your Padiepal Secret Key (starts with sk_live_). Used to verify webhooks.

Order Status After Payment

Check to mark orders Completed after payment (digital goods). Leave unchecked for Processing (physical goods).

Mark order as Completed after successful Padiepal payment

API URL — no trailing slash, no /api suffix

Enter just the domain: https://platface.com — not https://platface.com/api. The plugin adds /api/v1/ automatically.

Step 4

How Payment Notifications Work

After a customer pays, Padiepal sends a signed webhook notification to your WooCommerce store to mark the order as paid automatically.

Your WooCommerce Webhook URL

Padiepal automatically discovers this URL — no configuration needed on your end.

https://your-store.com/?wc-api=WC_Padipal_Gateway

Webhook Payload Example

JSON · POST · X-Padiepal-Signature: hmac-sha256

{

  "event":              "payment.success",

  "payment_ref":        "PAY-A1B2C3D4E5",

  "order_id":           "42",

  "trx_id":             "TRX-9F3A1C2E4D",

  "amount":             49.99,

  "fee":                0.75,

  "settled_amount":     49.24,

  "currency":           "USD",

  "payment_method":     "bank_card",

  "settlement_status":  "instant",

  "paid_at":            "2026-06-08T14:23:00Z"

}

How Signature Verification Works

            PHP · Verification (done automatically by the plugin)
          
// Raw JSON body from the request

$raw_body  = file_get_contents('php://input');

// Header sent by Padiepal

$signature = $_SERVER['HTTP_X_PADIEPAL_SIGNATURE'];

// Recompute using your Secret Key

$expected  = hash_hmac('sha256', $raw_body, $your_secret_key);

// Safe constant-time comparison

$valid = hash_equals($expected, $signature);

No extra webhook configuration needed

The plugin registers the webhook URL automatically with WooCommerce. Padiepal discovers and calls it during the payment flow — you only need to paste your keys and save.

Security

Best Practices

🔒

Never expose your Secret Key

Do not paste your sk_live_... key in public code, GitHub repos, or share it in emails or chats.

🔄

Regenerate if compromised

If you suspect your Secret Key has been leaked, go to Padiepal Dashboard → API Settings → Regenerate Keys immediately, then update the plugin with the new keys.

✅

Always verify webhook signatures

The plugin verifies every incoming webhook using HMAC-SHA256. Never disable this check — it prevents fraudulent payment notifications from reaching your store.

🌐

Use HTTPS on your store

Ensure your WordPress site runs on HTTPS. Padiepal only sends webhooks to HTTPS endpoints and will reject insecure callback URLs.

API Key pk_live_...

Secret Key sk_live_...