Tulu Infra Logo

API Keys

API keys are the credentials your application uses to authenticate with Tulu Switch. Each key pair consists of a public key and a secret key. Keys are scoped to a single environment (TEST or LIVE) — the environment is encoded in the key prefix so no separate configuration is needed.

Key Format

TypePublic key prefixSecret key prefix
TESTpk_test_sk_test_
LIVEpk_live_sk_live_

Environments

The environment is inferred from the key prefix. TEST keys route all operations to the sandbox — using provider test APIs and test wallets with no real money. LIVE keys route to production and process real money.

TEST and LIVE keys are managed independently. You can have up to 5 active key pairs per environment.

Managing Keys

API keys are generated and managed entirely from your dashboard — there is no API endpoint for key management. To create or manage your keys:

  1. Log in to your Tulu Switch dashboard.
  2. Navigate to Account > Developers in the sidebar.
  3. Select the environment (TEST or LIVE) and generate a new key pair.
  4. Copy both the public key and the secret key immediately — the secret key will not be shown again.

From the same page you can also view existing keys (public keys are masked), rotate a key pair, or revoke a key you no longer need.

Secret Key Exposure

The secret key is shown only once — at the moment of generation or rotation. It cannot be recovered after that point.

  • Copy and securely store the secret key immediately after generation.
  • If you lose your secret key, rotate the pair from the dashboard — the old key is revoked and a new secret is generated.
  • The public key is safe to reference but the secret key must never appear in client-side code, logs, or version control.
In the dashboard key list the public key is masked — only the first 12 characters are shown. The secret key is never shown in list views.

Limits

  • Maximum 5 active key pairs per environment (TEST and LIVE are counted separately).
  • Revoke an existing key from the dashboard before generating a new one if you have reached the limit.

LIVE Key Requirements

Generating a LIVE key pair requires your account to have:

  • A verified email address
  • KYB compliance status of APPROVED

The dashboard will indicate whether your account meets these requirements. The LIVE key generation option is hidden until all conditions are satisfied.

Complete your KYB via the KYB & KYC Verification guide.

Best Practices

  • Store secret keys in environment variables or a secrets manager — never hard-code them
  • Use separate key pairs for different services or deployments so you can revoke a single key without impacting everything
  • Rotate keys periodically and immediately whenever a key may have been exposed
  • Never commit API keys to version control; use .env files excluded from git
  • Keep TEST and LIVE key pairs in separate environment configurations to prevent accidental live transactions