API Keys vs. Tokenization Keys – Side-by-Side Comparison
| Feature | API Key | Tokenization Key |
| Purpose | Full gateway control | Card tokenization only |
| Can Charge Cards | Yes | No |
| Can Refund | Yes | No |
| Can Create Tokens | Yes | Yes |
| Can Access Data | Yes | No |
| Security Level | Highly sensitive | Less sensitive |
| Where Used | Server-side only | Client-side + server-side |
| Can Be Public | NO – must be secret | Yes – can be in JavaScript |
| PCI Scope | Increases PCI scope | Reduces PCI scope |
When to Use API Key:
- Backend server processing payments
- Shopping cart integrations
- Automated billing systems
- Internal processing tools
When to Use Tokenization Key:
- Website payment forms
- Mobile apps
- JavaScript widgets
- Any client-side card collection
Combined Usage (Most Common):
Most integrations use both:
- Tokenization key collects card on website (creates token)
- API key charges the token from backend server
This provides maximum security and minimum PCI burden.