To generate Papo API keys (https://papo.global/), go to the dashboard and navigate to Settings > Developers (or API). There you'll find your fixed public key and can create named secret keys, which are shown only once and must be stored in a secure location, such as a password manager or server environment variables.
The Papo API uses a key pair to identify and authenticate your account in integrations with CRMs, ERPs, automation platforms (n8n, Zapier), and your own systems. Understanding the difference between them and knowing how to generate and protect them is the first step to building reliable automations.
| Key Type | Format | Purpose | Exposure Level |
|---|---|---|---|
| Public Key | pk_live_... |
Uniquely identifies your Papo account. | Can be exposed in the frontend or in public scripts. |
| Secret Key | sk_live_... |
Authenticates requests and authorizes actions on your account. | Confidential – must never be shared or stored in code. |
How to generate the API keys
- Log in to the Papo dashboard and go to Settings.
- In the side menu, find the Developers or API section.
- The page will display your Public Key (
pk_live_...). It is fixed and can be copied at any time. - To obtain a Secret Key, click the button to create a new key.
- Give it a descriptive name (e.g., “CRM Integration”, “n8n Automation”) to make future management easier.
- The secret key (
sk_live_...) will be displayed only once. Copy it immediately and store it in a secure location.
⚠️ For security, Papo stores only the hash of the secret key. If you lose the original value, it cannot be recovered. In that case, revoke the compromised key and generate a new one.
How to store the keys securely
- Never put the secret key directly in source code, Git repositories, or messages.
- Use environment variables on your server (e.g.,
PAPO_SECRET_KEY) and reference them in code. - Store the key in a password manager (such as 1Password, Bitwarden, or your cloud provider's vault) for future reference.
- If the key leaks or is suspected of being compromised, go to the same developers page, find the key in the list, and revoke it immediately. Then create a new one and update your integrations.
What are these keys for?
The keys are used in all calls to the Papo API that require authentication. The secret key is sent in the Authorization header as a Bearer token. The public key can be sent in the X-Papo-Public-Key header as additional verification, but primary authentication always depends on the secret key.
With the keys in hand, you can, for example:
- Send WhatsApp messages via API.
- Query contacts extracted by the Extractor.
- Trigger Papo's artificial intelligence from your system.
- Sync data with your CRM or ERP.
Frequently Asked Questions
Where can I find my account's public key?
The public key (pk_live_...) is visible on the Settings > Developers (or API) page. It is fixed and can be copied whenever needed.
Can I have more than one secret key?
Yes. You can generate multiple secret keys, each with a different name (e.g., “Production”, “Test”, “n8n”). This helps isolate access and revoke a specific key without affecting the others.
I lost my secret key. What should I do?
The secret key cannot be recovered. Go to the developers page, revoke the lost key, and create a new one. Update your integrations with the new value.
Do I need the public key to authenticate?
Not necessarily. Authentication is done by the secret key. The public key is optional and serves as an additional identifier, but it does not replace the secret key.
How do I revoke a secret key?
In the key list on the developers page, find the key you want to disable and click the revoke option. From that point on, any request using that key will be refused.
Can I use the keys in tools like n8n or Zapier?
Yes. Papo API keys are compatible with any tool that supports Bearer token authentication. Simply enter the secret key in the tool's authorization field.
Read also
Create your free Papo account and get immediate access to the API keys to integrate your systems.