---
name: paystack-browser-safety
description: Use when deciding what Paystack SDK functionality can run in @alexasomba/paystack-browser versus what must move to a backend to protect secret keys and sensitive transactions.
license: MIT
compatibility: "Modern browsers and bundlers; package tooling/SSR builds require Node.js >=22.0.0; ESM package; public-key frontend runtime only."
---

# Paystack Browser Safety

The browser SDK is frontend-safe only when used with Paystack public keys and non-sensitive workflows. Anything requiring a secret key must run on a backend.

## Public key only

```ts
const paystack = createPaystack({
  apiKey: "pk_test_...",
});
```

The SDK rejects keys that look like `sk_test_*` or `sk_live_*`.

## Move these to a backend

- Transfers and transfer recipient management.
- Refunds and dispute operations.
- Webhook verification.
- Secret-key transaction verification before fulfillment.
- Settlement, balance, integration, dispute evidence, or account administration workflows.
- Any operation that would expose business-only credentials or privileged account state.

Generated helpers may exist for these operations because the SDK is generated from the full OpenAPI surface. Treat them as type-level visibility, not browser permission.

## Usually safe browser work

- Collecting frontend checkout inputs.
- Starting public-key checkout flows where Paystack permits browser calls.
- Calling frontend-safe read or initialization operations only when they do not require a secret key.
- Passing an `access_code` from your backend to `@alexasomba/paystack-inline`.

## Browser constraints

- CORS and Paystack API policy may prevent some direct frontend calls.
- Browser logs and source maps can expose data to users.
- Frontend state is not authoritative for payment fulfillment.

## Best practices

- Initialize payments on a backend and return only frontend-safe values when possible.
- Verify payment status server-side before delivering goods or credits.
- Keep public keys in frontend config and secret keys in backend secret storage.