The verdict in three sentences
A live API key sitting in a Git repo or a versioned .env file is an open door to an immediate fraudulent debit. The 2026 best practice rests on three pillars: encrypted storage in a secrets manager, automated quarterly rotation, and the ability to revoke in under 15 minutes. The cost of these controls is marginal against the risk: a single leaked key can drain a settlement balance of several million FCFA before the first alert.
Where keys leak, and what it costs
Most incidents come not from sophisticated hacking but from banal mistakes: a key committed to Git, exposed in a log, pasted into a support ticket, or left in a front-end variable. The mobile money problem: a live key often lets you initiate refunds or transfers, not just read data.
| Leak vector | Relative frequency | Time to abuse | Potential loss (order of magnitude) |
|---|---|---|---|
| Key committed to public Git | Very high | < 5 min (scanner bots) | Entire settlement balance |
| Key in application logs | High | Hours to days | Variable |
| Key hardcoded in front-end | High | < 1 h | Fraudulent refunds |
| Key shared by email/chat | Medium | Days | Depends on privileges |
| Test key mistaken for live | Medium | Immediate | Real transactions |
Bots scanning GitHub spot an exposed key in under five minutes. That is why detection is not enough: you must be able to revoke fast.
The protocol: controls and frequency
Each control has a target frequency. The goal is not perfection but methodical reduction of the attack surface, with the principle of least privilege at the center: a key should have only the strictly necessary rights (read-only for a dashboard, payment initiation for checkout, never everything at once).
| Control | Frequency | 2026 target | Setup cost |
|---|---|---|---|
| Encrypted storage (Vault / secrets manager) | Continuous | 100 % of live keys | 0 to 50,000 FCFA/month |
| Key rotation | Quarterly | < 90 days old | Automatable |
| Test / live separation | Permanent | Prefixed keys, isolated environments | Free |
| Least privilege (scopes) | On each creation | 1 key = 1 use | Free |
| Anomalous usage alert | Real time | Notification < 2 min | Low |
| Revocation time | On incident | < 15 min | Written procedure |
| Secrets scan in CI | On each push | 0 committed secrets | Free (open source tools) |
A secrets scanner in continuous integration (pre-commit + CI pipeline) blocks 90 % of leaks before they reach the remote repo. It is the best cost/benefit control.
Mini case study
Awa runs an e-commerce shop in Dakar with a Wave and Orange Money checkout. An intern mistakenly pastes the live key into a public team Slack message. Without a protocol, the key stays valid for weeks. With the Kolonell protocol: the anomalous usage alert fires on the first request from an unknown IP, the team revokes the key in 11 minutes and generates a new encrypted one in the secrets manager. Loss avoided: the day's settlement balance, roughly 1,800,000 FCFA. Cost of protection: a 15-minute procedure and a free scanning tool.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
How often should payment keys be rotated?
Quarterly rotation (less than 90 days old) is a good 2026 compromise. If a leak is suspected, rotation is immediate, not scheduled. Automation prevents forgetting.
What is the difference between a test key and a live key?
The test key simulates payments with no real money movement; the live key actually debits. Confusing them in production can trigger real transactions. Prefix them clearly and isolate environments.
What to do in the 15 minutes after a leak?
Revoke the compromised key, generate a new one, review recent transactions, and notify the aggregator. A time under 15 minutes strongly limits the possible fraudulent debit.
Does a small merchant really need a secrets manager?
Yes, even a basic one. An encrypted server-side environment variable is enough to start; the key point is never versioning the key nor exposing it client-side. The cost can be zero.
How do you detect anomalous use of a key?
Monitor request spikes, unknown IPs, unusual amounts, and unexpected refund calls. A real-time alert under 2 minutes is the goal.
Let's talk about your project. We audit your payment secrets and set up rotation, scopes, and alerts within days. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
