Dashboard
What the merchant dashboard offers — projects, credentials, webhooks, and transactions.
The merchant dashboard is where you manage your HellOOpass presence — projects, credentials, webhooks, and settlement.
What's in the dashboard
- Project settings and approval status
- Credential viewing and rotation (sandbox and production kept separate)
- Webhook endpoint URL and signing secret
- Transaction search, statuses, and settlement status
API credentials
Once your business and project are approved, HellOOpass issues API credentials.
How you get them
- Email — retrieval instructions sent to your registered work email
- Merchant dashboard — open your project and view credentials anytime; if keys are missing, the project may still be under review
Key types
| Key | Where it lives | Purpose |
|---|---|---|
| Publishable / test key | Frontend or sandbox testing | Identifies your project client-side; never authorizes privileged calls |
| Secret API key | Backend servers only | Authorizes all privileged calls via an Authorization: Bearer header |
Placeholder credential names
Key names and header shapes are illustrative until the final HellOOpass API contract is published.
Security rules
- Backend only — never ship the secret key in frontend or mobile code
- Store in environment variables or a secrets manager, never hardcoded
- Never commit keys to git; add
.envto.gitignore - Rotate immediately if a key is exposed; treat sandbox and production keys as separate secrets
# .env — backend only, never committed
HELLOOPASS_SECRET_KEY=YOUR_SECRET_API_KEY
HELLOOPASS_BASE_URL=https://sandbox-api.helloopass.exampleSee Authentication · Security Best Practices · API Environments