How do I rotate my Trama API key?
Open your dashboard and go to Settings → API keys. Click “Create new key” to mint a fresh key, copy it immediately (the full value is shown only once), and update your app or environment variables with the new value. Once your integrations are using the new key, revoke the old one from the same page.
Rotating is safe to do anytime — a new key works instantly, and revoking the old key takes effect immediately. If a key is ever exposed, revoke it right away and create a replacement.
What is the difference between live, test, and public keys?
A live key (prefixed tr_live_) is a server-side secret for production traffic — keep it on your backend, never in browser code. A test key (tr_test_) behaves the same but is for development and staging. A public key (tr_pub_) is the only key safe to use in the browser: it is read-only and locked to the website origins you allow, so it cannot be misused if someone reads your frontend source.
Rule of thumb: anything running in a customer’s browser uses a tr_pub_ key; anything on your server uses a tr_live_ key.
Where do I find my API key?
Your dashboard, under Settings → API keys. You can create separate keys for production, testing, and your public storefront, and revoke any of them independently. For security we only store a hashed version of each key, so the raw value is shown once at creation — copy it then.
Is it safe to put a Trama key in my frontend?
Only a public key (tr_pub_). Create one in Settings → API keys, set the allowed website origins (for example your store’s domain), and use it in your storefront. Never put a live (tr_live_) or test (tr_test_) key in browser code — those are server-side secrets.