Credentials and environments

Use separate credentials for test and production. PUBLIC_API_ORIGIN only identifies the origin visible to the browser; TIMBRO_PAYMENTS_SECRET_KEY, certificates, Auth1/Auth2 values, and webhook secrets belong only on the server or in the environment secret store. Never publish an administrative key or provider credential in the bundle.

The browser receives a scoped Checkout session or token; it never receives an administrative key or provider secret. Record the environment with every payment reference so inquiry cannot cross accounts.

See the REST reference for the implemented contract’s names, types, and responses.

import { createTimbroPayments } from "@timbro/payments";

const secretKey = process.env.TIMBRO_PAYMENTS_SECRET_KEY;
if (!secretKey) throw new Error("Missing TIMBRO_PAYMENTS_SECRET_KEY");
const timbro = createTimbroPayments({ secretKey });
const payment = await timbro.payments.retrieve("payment_123");

Pin the environment beside every reference and reject configurations that mix a test origin with a production key. Rotate secrets in the secret store, never in source code or a URL.