API Keys

Securely authenticate your server-side requests to the TriBridge API.

One Keypair, Two Modes

When you generate keys from your dashboard, TriBridge issues a single keypair containing both a test and a live key. Each key is shown exactly once at creation time — store it somewhere safe.

Test Key

tri_test_...

Routes payments through test mode. No real funds move. Use this while building and validating your webhooks.

Live Key

tri_live_...

Activates real on-chain payments. Never expose it publicly, and only switch to it once your integration is verified in test mode.

Example keypair response

{
  "keypair_id": "f4c2...b91a",
  "test":  { "full_key": "tri_test_9f3a...", "is_test": true },
  "live":  { "full_key": "tri_live_2b7c...", "is_test": false }
}

Webhook Secrets

Separately from your API keys, every webhook endpoint you register receives its own signing secret. This secret is returned only once when the endpoint is created and is used to verify that incoming webhook payloads genuinely originated from TriBridge. Treat it like a password.

Create a webhook (returns secret once)

curl -X POST https://tribridge.onrender.com/webhooks \
  -H "Authorization: Bearer <YOUR_JWT>" \
  -H "Content-Type: application/json" \
  -d '{ "url": "https://yoursite.com/tb-webhook", "is_test": true }'

Security Best Practices

Always load your keys from environment variables — never hardcode or commit them.
The test and live keys are a pair: revoking one revokes both. Plan key rotation accordingly.
If a key is compromised, revoke it immediately from the merchant dashboard and generate a fresh keypair.
Your webhook signing secret is shown once. Store it securely; you cannot retrieve it again.