Frame
Selects which credential authenticates a Frame API request.
The Frame Android SDK is publishable-key first: client-safe endpoints (tokenization, config, charge confirm) authenticate with your publishable key (pk_). A publishable key is safe to embed in an app binary — it can only tokenize and retrieve/confirm objects the client already owns.
Warning: Secret sends your secret key (
sk_), which grants full merchant privileges. A secret key must never ship inside an app binary; serve it only from your backend. The SDK emits a one-time runtime warning the first time Secret is used.
Inheritors
Types
Authenticate with a server-minted, per-object client secret used as a Bearer token.
Authenticate with the publishable key (pk_). Default for all client-safe endpoints.
Authenticate with the secret key (sk_). Server-only — avoid shipping this in an app binary.