Getting your API keys

​

What you get

​

Create a key

1

Open Developers

In the Laces app, go to Settings and scroll to the bottom. Tap Developers (“API keys, webhooks and integrations”). Only owners and admins see this tile.

The first time you open Settings, a short guide highlights the tile. You can replay it any time from Settings → Get help → How to use the app.

2

Start a new key

In API keys, tap Create key. Until you have made one, the section shows an empty state.

3

Name it

Name is only for you, to tell keys apart, for example “Partner website” or “Club site”. Use one key per site, so you can revoke one without breaking the others.

4

Choose permissions

Permissions are the scopes. Three are on by default: Read events, Create orders and Start hosted checkout.Read orders (orders:read) is off by default. It lets the key read every order in your organization including names, emails and phone numbers. Leave it off unless your server genuinely needs it; webhooks and checkout session reads tell you payment outcomes without it.

5

Enter your domains

Two lists, explained below:

• Allowed domains: websites that may use the publishable key, for example https://shop.example.com.
• Return URL domains: websites a checkout may send people back to afterwards.

6

Create it and copy the secret

Tap Create key. The Your new key sheet shows the Client ID, the Secret and the Publishable key, each with a copy button. Copy all copies all three as a block you can paste into a .env file:

.env

LACES_CLIENT_ID=LCSCLI-EXAMPLECLNT2345EXAMP
LACES_CLIENT_SECRET=LCSSECK-EXAMPLE…SECRE-X
LACES_PUBLISHABLE_KEY=LCSPUBK-ABCDEFGHJKLMNPQRSTUVWXYZ23456789-X

Copy the secret now and put it in your server’s secret manager or environment. Laces stores only a hash of it, so it can never be shown again. If you lose it, regenerate your keys.

After you confirm, the key appears in your list with its secret masked to the last four characters.

Tap a key to open its detail screen, where you can edit permissions and domains, regenerate the keys or revoke the key.

​

Allowed domains vs return URL domains

• Exact origins only: scheme, host and an optional port. No wildcards, no paths, no query strings.
  • https://shop.example.com is valid.
  • https://*.example.com and https://example.com/events are not.
• https only, with one exception for local development (below).
• https://example.com and https://www.example.com are different origins. List both if you serve both.
• Up to 20 entries per list.

​

Local development domains

​

Manage a key

​

Regenerate keys

1. Tap Regenerate keys and read the confirmation. Tap Regenerate.

   

2. The app shows the new secret and the new publishable key once, with copy buttons and Copy all. Copy them now.
3. Deploy the new secret to your servers. The old secret keeps working for 24 hours, so there is no downtime on the server side.
4. Update your website with the new publishable key right away. The old publishable key stops working immediately.

​

Revoke

​

Key formats

const PUBLISHABLE = /^LCSPUBK-[A-HJ-NP-Z2-9]{32}-X$/;
const SECRET      = /^LCSSECK-[A-HJ-NP-Z2-9]{52}-X$/;
const CLIENT_ID   = /^LCSCLI-[A-HJ-NP-Z2-9]{20}$/;