Encrypted Keys
Your Payment and Courier Keys, Sealed
The keys that move your money and your parcels deserve more than a password field. Mercayo seals them the moment you save them, and no screen ever shows them again.
- In every plan
- Free for 14 days
Kosha is a demo store on Mercayo. Its products, orders and customers are sample data.
In short
What It Does
When you connect a service, its secret parts are sealed:
| Service | What Is Sealed | Where You Enter It |
|---|---|---|
| Razorpay | Your key secret, and the webhook secret Mercayo creates for your store | Settings → Payments |
| Shiprocket | Your API user's password, the sign-in Shiprocket gives back (renewed by itself), and the webhook's security token | Settings → Couriers |
| Meta and Google | The Conversions API access token and the GA4 Measurement Protocol API secret, for purchases sent from the server | Settings → Pixels, Cookies and App |
Sealed means encrypted (AES-256-GCM) with a key that is kept outside the database. The database never sees that key, so even a full copy of the database cannot open the secrets in it. Each sealed secret is also bound to your store: copied into another store's row, it does not open. And the encryption checks itself: a sealed value changed by even one character refuses to open rather than giving a wrong secret.
Never Shown, Never Readable from a Screen
No screen ever shows a saved secret again, to you, your team or Mercayo's support. The sealed values cannot be read by any request from your admin at all, not even in their encrypted form. Where it helps you recognise what is saved, the admin shows a hint only:
- Razorpay: the key id with its middle hidden (rzp_live_••••3xyz), the mode (test or live) and when it was connected;
- Shiprocket: the API user's email, partly hidden, and when the sign-in renews;
- Meta and Google tokens: "Set, ends in" their last 4 characters.
Secrets are opened only on Mercayo's server, at the moment they are used: creating a Razorpay payment or a refund, making a label with Shiprocket, sending a purchase to Meta. To change a secret, you enter it again; disconnecting removes it.
Webhook Secrets, Shown Once
For Razorpay and Shiprocket, Mercayo makes a fresh webhook secret for your store and shows it once, with the steps to paste it into the service's dashboard. Every notice the service sends back is checked against that secret before anything in your store changes, so nobody else can send your store a fake "payment captured" or "delivered".
For your store
Why It Matters
Anyone with your Razorpay secret could refund money; anyone with your courier sign-in could book parcels on your wallet. Keeping these secrets sealed, bound to your store and never displayed means a leaked screenshot, a curious helper or a stolen database copy is not enough to misuse them.
Sealing also protects you from mistakes inside your own team: nobody can copy a key from a screen into a chat by accident, because no screen ever shows it. That matters when a freelancer or a family member helps with the settings, or when you share your screen on a call to get help.
Keys are still easy to manage: you paste a key once when you connect, see at a glance which account is connected, and replace it in a minute if you ever think it has leaked.
Step by step
How It Works
Enter the Secret Once
In Settings → Payments, Settings → Couriers, or Settings → Pixels, Cookies and App, paste the secret and save. Its shape is checked first (a Razorpay key id must start with rzp_test_ or rzp_live_), and Shiprocket's sign-in is tried with Shiprocket before anything is kept: a refusal saves nothing.
It Is Sealed at Once
Mercayo's server encrypts the secret with the sealing key, binds it to your store, and stores only the sealed form. If secure storage is not ready on the server, the save is refused in plain words and nothing is kept: a secret is never saved unsealed.
Copy the Webhook Secret Now
For Razorpay and Shiprocket, the screen then shows the webhook address and a secret made for your store, with the steps for the service's dashboard. Paste them in, then press DONE, I HAVE ADDED IT. This is the only time that secret is shown.
It Is Never Shown Again
From then on the screen shows that a secret is saved, with a hint (a hidden key id, a partly hidden email, or the last 4 characters), never the secret itself. The same is true for every person on your team and for Mercayo's support.
Replace It When You Need To
If a key may have leaked, make a new one at the service and enter it: REPLACE KEYS for Razorpay (with a new webhook secret to update), RECONNECT for Shiprocket (your webhook keeps working), REPLACE for a Meta or Google token. DISCONNECT or REMOVE deletes the sealed secret.
Settings
Settings You Control
Each one is in your admin. A new store starts with the value shown.
Nothing to set up: it works the same way in every store.
Mercayo
Mercayo's Controls
Mercayo holds the sealing key outside the database, on its servers only, and each sealed value names the version of the key that sealed it. Mercayo's team cannot read your saved secrets through any screen, support sessions included, and changing payment settings is withheld from support sessions unless Mercayo's owner allows it for that one session. Secrets are opened only by Mercayo's server, for your store, at the moment they are used.
Limits today
Good to Know Before You Start
- If you lose a secret, you get a new one from the service (Razorpay, Shiprocket, Meta, Google) and enter it again; Mercayo cannot show it to you.
- A webhook secret is shown only once; if you lose it, connect again (REPLACE KEYS for Razorpay, disconnect and connect for Shiprocket) for a new one.
- Sealing protects keys stored with Mercayo; keys you keep elsewhere (in your Razorpay or Shiprocket dashboard, or your own notes) are yours to protect.
Questions
About Encrypted Keys
Can Mercayo's support see my Razorpay secret?
No. No screen shows it to anyone, and the sealed value cannot even be read by a request from the admin. Support sessions also cannot change payment settings unless Mercayo's owner allows owner powers for that one session.
What if someone copies the database?
The secrets in it are encrypted with a key kept elsewhere, which the database never sees, so the copy alone cannot open them. Each secret is also bound to its store, so moving it to another store's row does not open it either.
Why do I have to paste the webhook secret right away?
Because it is shown only once, when it is created, and is then sealed like your other secrets. If you lose it, connect again for a new one: REPLACE KEYS for Razorpay, or disconnect and connect for Shiprocket.
Which keys are sealed?
Your Razorpay key secret and webhook secret; your Shiprocket API user's password, its sign-in and its webhook token; and the server tokens for Meta and Google purchase events. Ids that are not secret, such as your Meta pixel ID or Razorpay key id, are kept as they are.
Who on my team can enter or replace keys?
Razorpay keys need Change payment settings in a person's role; courier accounts and the Meta and Google tokens need Change settings. The owner and admins hold both. Every change of a payment or courier account is in your activity log, without the secret.
What does sealed mean, exactly?
The secret is encrypted with AES-256-GCM using a key held only on Mercayo's servers, outside the database, with your store's identity bound in. The encryption detects any change to the stored value, so a tampered secret refuses to open.
Related
Related Features
- RazorpayPaste your Razorpay keys, test with test keys first, and Mercayo sets up the webhook secret; the money goes straight to your account.
- ShiprocketConnect your own Shiprocket account with an API user, add Mercayo's webhook, and make labels, book pickups and follow parcels without opening Shiprocket.
- Ads Pixels and Analytics TagsAdd your Meta pixel, Google Analytics 4, Google Ads, Pinterest and Clarity tags by their ids; they load only after shoppers agree.
- Store IsolationEvery store's orders, shoppers and products are walled off by the database itself, and tests prove one store can never reach another's.
- Support AccessWhen Mercayo's support team opens your admin to help, it is a time-limited session with a reason, recorded, and by default shown to you with what was changed.
More in Security and Trust: Store Isolation · Staff and Roles · Two-Step Sign-In · Activity Log · Support Access · Privacy and Consent
Try It on Your Own Store
Every feature is in every plan, free for 14 days.
