Obtain Provider Keys & Webhook Secrets
Understand public keys, secret keys, merchant IDs, test credentials, live credentials, and webhook secrets.
Overview
Never place secret keys or webhook secrets in screenshots, browser code, ordinary email, chat, or repositories. Rotate exposed credentials immediately.
Who should use it
Workspace owners, operations teams, sales users and authorized technical users.
Where to find it in Wemblo
Wemblo -> My Subscription -> Payment Gateway
Before you begin
- Use the correct workspace and authorized role.
- Prepare fictional Pakistan test data.
- Confirm connected provider accounts where required.
- Define who approves price, stock, booking, payment or final status.
Main concepts and fields
| Concept / Field | Meaning or Use |
|---|---|
| Public Key / Merchant ID | Provider identifier. |
| Secret Key | Private server credential. |
| Webhook Secret | Verifies provider payment events. |
| Test Credential | Used in sandbox or test mode. |
| Live Credential | Used only after production approval. |
Step-by-step instructions
- Open Wemblo -> My Subscription -> Payment Gateway.
- Define one business purpose and owner.
- Create or select the required configuration.
- Enter the required fields and mappings.
- Connect the approved provider or resource where needed.
- Add validation, confirmation and human review.
- Save.
- Run a fictional end-to-end test.
- Review logs, status and customer notification.
Test and verification
- Complete one successful path with fictional data.
- Complete one invalid, failure or permission path.
- Confirm the result appears in the correct workspace and module.
- Confirm the correct person or team can review and continue the work.
Common issues and solutions
| Issue | What to Check |
|---|---|
| Configuration does not save | Required fields, validation, permission and active workspace. |
| External action fails | Credential, provider status, endpoint or field mapping. |
| Duplicate record or action | Event ID, idempotency, retries and existing record. |
| Customer notification is missing | Template, channel connection, status transition and contact details. |
Security, privacy, consent, cost and provider notes
- Use only data the business is authorized to process.
- External provider charges, policies, approvals, limits and availability remain separate.
- Do not expose passwords, API keys, tokens, webhook secrets, payment credentials or private customer data.
- Use human review for sensitive, regulated, urgent, financial or final decisions.
Last reviewed: