> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pulseshiga.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Get your API keys

> How to obtain sandbox and live Pulse credentials, and where each key is used.

Pulse credentials are provisioned by the Shiga team — there isn't a self-serve
dashboard yet. Request access, then use the keys you're issued in the guides that follow.

<Card title="Request access" icon="envelope" href="mailto:support@shiga.io">
  Email **[support@shiga.io](mailto:support@shiga.io)** with your company and use case to be issued a sandbox key.
</Card>

You'll receive a **sandbox** secret key (`sk_test_…`) to build against, and a **live**
secret key (`sk_…`) when you're ready for production.

## Key types

| Key                    | Prefix      | Lives             | Used for                                                                        |
| ---------------------- | ----------- | ----------------- | ------------------------------------------------------------------------------- |
| Secret key (live)      | `sk_…`      | Your backend only | Authenticating `@pulsebyshiga/node` against the engine                          |
| Secret key (sandbox)   | `sk_test_…` | Your backend only | The same, against the sandbox — simulate the lifecycle without funds            |
| Client session token   | `cs_…`      | The browser       | Minted server-side by `collectionSessions.create`; opens the embedded component |
| Webhook signing secret | `whsec_…`   | Your backend only | Verifying the `Pulse-Signature` header on webhook deliveries                    |

<Note>
  Your secret key (`sk_…`) and any user identity (BVN/NIN) stay **only** between
  your backend and Pulse. The browser only ever holds a single short-lived client
  session token (`cs_…`) scoped to one order — never the secret key.
</Note>

<Note>
  A self-serve dashboard and a dedicated sandbox host are on the roadmap. Until then,
  keys are issued on request and you point the SDK at the sandbox by overriding `baseUrl`.
</Note>