An API key is a credential an application uses when communicating with a service. Its permissions and handling rules depend on the provider. Stripe, for example, distinguishes publishable keys from secret keys and separates testing from live operation. Source: Stripe: API keys

Check the type before sharing it

Record the key’s owner, purpose and environment without copying its secret value into an ordinary support note. Ask the integration team which approved storage and transfer process applies. This keeps a useful record without turning the record itself into another place where credentials are exposed.

Treat a supplier connection as a controlled change

Before enabling a live travel integration, verify that the credentials belong to the intended account and environment. Pair that check with an agreed test, so a label in a settings screen is not the only evidence of the connection being used.

Stripe explicitly warns against exposing secret keys in public locations. If a secret is exposed, follow the provider’s replacement and incident process rather than assuming that removing the visible copy resolves the issue. Source: Stripe: API keys

Written and updated by Travelgenix. Sources checked on 16 October 2026. Worked examples and checklists are editorial illustrations and recommendations, not customer results.