How to rotate your
Seamless ACH API keys

Overview

What rotation does

Rotating replaces your keys in one click. Your account, customers, payments and webhook URL stay exactly as they are.

Inventory

Where your keys may be used

After the rotation, every item that applies to you must get the new key. pk_ = publishable key, sk_ = secret key.

After rotation

Where to replace the keys

Go through every section that applies to your setup.

1. WordPress / WooCommerce plugin secret key

   • Sign in to your WordPress admin and open the Seamless ACH plugin settings:
     wp-admin/admin.php?page=seamless-ach_gateway
   • Paste the new live secret key into Seamless ACH Live Secret Key (sk_…).
   • If you also rotated sandbox keys, paste the new one into Seamless ACH Test Secret Key (sk_test_…).
   • Check that Mode is set correctly (Live or Sandbox) and save the settings.
   • The plugin's webhook URL does not change — no update is needed in the dashboard.

   

   Docs: Installation Guide — Seamless ACH x WooCommerce · Sync order statuses via webhooks

2. Checkout.js publishable key

   Find the place where your site creates the checkout and replace the publicKey value. Use the publishable key only:

   var seamlessach = new SEAMLESSACH({
     publicKey: 'pk_xxxxxxxxxxxxxxxxxxxxxxxxxx', // new publishable key (pk_test_… for sandbox)
     sandbox: false,                          // true together with a pk_test_ key
     displayMethod: 'iframe',
     // …the rest of your configuration stays the same
   });

   • Search your site's code and theme files for publicKey and pk_ — the key may be in a template, a JS bundle or a tag manager.
   • If your site is built and deployed (React, Vue, Angular, etc.), rebuild and redeploy, then clear the CDN / browser cache.
   • Make sure the SDK script is loaded from https://dev-ach.seamlesschex.com/checkoutjs/sdk-min.js.
   ⛔

   Never put the secret key into the website

   Anything in the browser is visible to every visitor. Checkout.js only needs the publishable key, and requests that use a secret key from a browser are rejected.

   Docs: Checkout.js Documentation · Direct Debits / Credits / Subscriptions · On-Demand Payments

3. Plaid bank-link URL or iframe publishable key

   If you send customers to the hosted bank-linking page or embed it in an iframe, the publishable key is part of the URL. Rebuild it with the new key:

   https://dashboard.seamlesschex.com/ach/#/bank-account/pk_xxxxxxxxxxxxxxxxxxxxxxxxxx/{USER_ID}?successUrl={SUCCESS_URL}&cancelUrl={CANCEL_URL}

   • Update the code or template that builds the link and the src of the iframe.
   • Links that were already generated with the old key (in emails, SMS, saved pages) stop working — send customers a new link.

   Docs: Plaid Authorization (Bank Account Verification)

4. Your server code — REST API secret key

   Every server-to-server call is authorized with the secret key. Replace it where your application reads it — ideally a single environment variable or secret:

   curl -X GET https://api.seamlesschex.com/ach/v2/user/{user_id} \
     -H "Authorization: Bearer sk_xxxxxxxxxxxxxxxxxxxxxxxxxx" \
     -H "Content-Type: application/json"
   
   # .env
   SEAMLESS_ACH_SECRET_KEY=sk_xxxxxxxxxxxxxxxxxxxxxxxxxx

   • Update every environment: production, staging, background workers, cron jobs and serverless functions.
   • Restart or redeploy the services so they pick up the new value.
   • Check your logs for 401 / 403 responses after the switch — they point to a place that still uses the old key.

   Docs: Seamless ACH API — Quick-Start · API Reference

5. Your webhook handler secret key

   Seamless ACH webhook requests carry your secret API key in the Authorization header. If your handler verifies that header, update the expected value to the new secret key.

   • For a short transition period, accept both the old and the new secret key: retries of events created before the rotation may still arrive with the previous key. Remove the old key after a few days.
   • Your webhook URL itself does not change. You can see and test it on the same Seamless ACH API page.

   Docs: Webhooks Overview · Set Webhook URL

6. Postman and testing tools secret key

   • In Postman, open the environment (or collection variables) you use with the Seamless ACH REST API collection and update the secretKey value.
   • Update automated tests, monitoring checks and local developer configs.
   • Do not commit keys to Git — if a key was ever committed, consider it exposed and rotate it.

7. Everything else

   • Secret managers and environment variables — AWS Secrets Manager, Google Secret Manager, Vault, Heroku / Vercel / Netlify settings, Docker and Kubernetes secrets.
   • CI/CD — GitHub Actions / GitLab CI secrets and deploy pipelines.
   • Third-party tools and automations — CRM, Zapier / Make, accounting or e-commerce connectors where you pasted a Seamless ACH key.
   • Developers and agencies — if someone else maintains your integration, send them the new key through a secure channel, not email or chat.

Good to know

Publishable vs. secret key

Use each key only where it belongs.