What should I do if my Paystack dashboard is compromised?

Act fast: (1) Log in and immediately go to Settings → API Keys → Regenerate your live secret key. (2) Go to Settings → Team and revoke any suspicious accounts or sessions. (3) Enable 2FA if not already done. (4) Review recent transactions and transfers for unauthorized activity. (5) Contact Paystack support to report the incident and get help identifying any unauthorized actions.

Can I restrict which IP addresses can access the Paystack dashboard?

Paystack does not currently offer IP allowlisting for dashboard access (as of 2026). Compensate with strong 2FA, individual accounts per team member, and monitoring for login alerts. For your own internal admin panel that calls the Paystack API, you can add IP allowlisting at the infrastructure level.

How often should I rotate Paystack API keys?

At minimum: rotate on team member departure, on suspected exposure, or after any security incident. Some security policies mandate periodic rotation every 90 days regardless. More frequent rotation is safer but requires a reliable secrets deployment pipeline so you can update production without downtime.

Is the Paystack public key (pk_live_...) sensitive?

The public key is designed to be used in frontend code — it is not secret. You can safely include it in your JavaScript or mobile app. The secret key (sk_live_...) is what must be protected. Never expose the secret key in frontend code or public repositories.

By Bonaventure Ogeto|Updated July 22, 2026

Securing Admin Access to Your Paystack Dashboard

Enable two-factor authentication (2FA) on every Paystack dashboard account — especially the admin account. Never share login credentials between team members: use Paystack's team invite feature so each person has a separate login with an appropriate role. Rotate your live secret key if any team member with access leaves. Monitor your API key usage for unexpected activity. Restrict the "Transfers" permission in the dashboard to as few accounts as possible.

Enabling Two-Factor Authentication

Two-factor authentication (2FA) stops most account takeover attacks — even if your password is stolen, an attacker cannot log in without the second factor.

Log in to your Paystack dashboard at dashboard.paystack.com
Click your account name (top right) → Account Settings
Select Security → Enable 2FA
Scan the QR code with an authenticator app (Google Authenticator, Authy, or 1Password)
Enter the 6-digit code to confirm
Save your backup codes in a secure location (not in email)

Require all team members with dashboard access to enable 2FA. An admin account without 2FA is a single password guess away from full compromise.

Using Team Invites Instead of Shared Credentials

Sharing a single login across your team means:

You cannot audit who performed which action
Offboarding requires a password change that locks everyone out temporarily
One team member's compromised device exposes the shared account

Instead, use Paystack team invites:

Go to Settings → Team in the Paystack dashboard
Click Invite new member
Enter the team member's email and select their role:

Dashboard Role	Access
Admin	Full access: API keys, transfers, settings, team management
Developer	View transactions, access API keys, manage webhooks. Cannot initiate transfers.
Finance	View transactions and settlements, download reports. No API key access.

Assign Finance role to customer support and accounting staff. Assign Developer role to engineers who need to debug transactions. Keep Admin accounts minimal — ideally one or two founders or senior engineers.

Get weekly developer tips

Join 25,000+ developers. Practical guides, job tips, and new content — straight to your inbox.

No spam. Unsubscribe anytime.

API Key Rotation and Storage

Your Paystack live secret key is equivalent to full access to your payment account. Treat it like a password:

Store in secrets managers — AWS Secrets Manager, HashiCorp Vault, Vercel Environment Variables, or Supabase Secrets. Not in code, not in .env files committed to git.
Rotate on team member departure — Generate a new secret key in Settings → API Keys whenever anyone with key access leaves.
Rotate on suspected exposure — If the key appears in a log file, a leaked .env, or a public repo: generate a new key immediately, then update your production environment.
Separate test and live keys — Your CI/CD pipeline should use test keys only. Live keys should only be in production environment secrets.

Learn More

This guide is part of the Paystack security guide.

Sign up for the McTaba newsletter

Key Takeaways

✓Enable 2FA on your Paystack dashboard admin account — this is the single highest-impact security action you can take.
✓Never share dashboard credentials. Use Paystack team invites (Settings → Team) so each member has their own login with assigned role.
✓Three Paystack dashboard roles: Admin (full access), Developer (API keys, transaction view), Finance (transaction history, reports only).
✓Rotate your live secret key any time a team member with key access leaves, or whenever you suspect exposure.
✓Keep live and test API keys in a secrets manager, not in Slack messages, emails, or .env files committed to git.
✓Review your dashboard team member list every quarter — remove people who no longer need access.

Frequently Asked Questions

What should I do if my Paystack dashboard is compromised?: Act fast: (1) Log in and immediately go to Settings → API Keys → Regenerate your live secret key. (2) Go to Settings → Team and revoke any suspicious accounts or sessions. (3) Enable 2FA if not already done. (4) Review recent transactions and transfers for unauthorized activity. (5) Contact Paystack support to report the incident and get help identifying any unauthorized actions.
Can I restrict which IP addresses can access the Paystack dashboard?: Paystack does not currently offer IP allowlisting for dashboard access (as of 2026). Compensate with strong 2FA, individual accounts per team member, and monitoring for login alerts. For your own internal admin panel that calls the Paystack API, you can add IP allowlisting at the infrastructure level.
How often should I rotate Paystack API keys?: At minimum: rotate on team member departure, on suspected exposure, or after any security incident. Some security policies mandate periodic rotation every 90 days regardless. More frequent rotation is safer but requires a reliable secrets deployment pipeline so you can update production without downtime.
Is the Paystack public key (pk_live_...) sensitive?: The public key is designed to be used in frontend code — it is not secret. You can safely include it in your JavaScript or mobile app. The secret key (sk_live_...) is what must be protected. Never expose the secret key in frontend code or public repositories.

Learn Paystack Integration

KES 2,999

The definitive guide to building payment systems with Paystack — from your first transaction to production-grade payment infrastructure across Africa. 9 modules, 47 lessons. Free preview available.

Start Paystack Course

Not ready? Create Free Account

By Bonaventure Ogeto|Updated July 22, 2026

Securing Admin Access to Your Paystack Dashboard

Enabling Two-Factor Authentication

Two-factor authentication (2FA) stops most account takeover attacks — even if your password is stolen, an attacker cannot log in without the second factor.

Log in to your Paystack dashboard at dashboard.paystack.com
Click your account name (top right) → Account Settings
Select Security → Enable 2FA
Scan the QR code with an authenticator app (Google Authenticator, Authy, or 1Password)
Enter the 6-digit code to confirm
Save your backup codes in a secure location (not in email)

Require all team members with dashboard access to enable 2FA. An admin account without 2FA is a single password guess away from full compromise.

Using Team Invites Instead of Shared Credentials

Sharing a single login across your team means:

You cannot audit who performed which action
Offboarding requires a password change that locks everyone out temporarily
One team member's compromised device exposes the shared account

Instead, use Paystack team invites:

Go to Settings → Team in the Paystack dashboard
Click Invite new member
Enter the team member's email and select their role:

Dashboard Role	Access
Admin	Full access: API keys, transfers, settings, team management
Developer	View transactions, access API keys, manage webhooks. Cannot initiate transfers.
Finance	View transactions and settlements, download reports. No API key access.

Get weekly developer tips

Join 25,000+ developers. Practical guides, job tips, and new content — straight to your inbox.

No spam. Unsubscribe anytime.

API Key Rotation and Storage

Your Paystack live secret key is equivalent to full access to your payment account. Treat it like a password:

Store in secrets managers — AWS Secrets Manager, HashiCorp Vault, Vercel Environment Variables, or Supabase Secrets. Not in code, not in .env files committed to git.
Rotate on team member departure — Generate a new secret key in Settings → API Keys whenever anyone with key access leaves.
Rotate on suspected exposure — If the key appears in a log file, a leaked .env, or a public repo: generate a new key immediately, then update your production environment.
Separate test and live keys — Your CI/CD pipeline should use test keys only. Live keys should only be in production environment secrets.

Learn More

This guide is part of the Paystack security guide.

Sign up for the McTaba newsletter

Key Takeaways

✓Enable 2FA on your Paystack dashboard admin account — this is the single highest-impact security action you can take.
✓Never share dashboard credentials. Use Paystack team invites (Settings → Team) so each member has their own login with assigned role.
✓Three Paystack dashboard roles: Admin (full access), Developer (API keys, transaction view), Finance (transaction history, reports only).
✓Rotate your live secret key any time a team member with key access leaves, or whenever you suspect exposure.
✓Keep live and test API keys in a secrets manager, not in Slack messages, emails, or .env files committed to git.
✓Review your dashboard team member list every quarter — remove people who no longer need access.

Frequently Asked Questions

What should I do if my Paystack dashboard is compromised?: Act fast: (1) Log in and immediately go to Settings → API Keys → Regenerate your live secret key. (2) Go to Settings → Team and revoke any suspicious accounts or sessions. (3) Enable 2FA if not already done. (4) Review recent transactions and transfers for unauthorized activity. (5) Contact Paystack support to report the incident and get help identifying any unauthorized actions.
Can I restrict which IP addresses can access the Paystack dashboard?: Paystack does not currently offer IP allowlisting for dashboard access (as of 2026). Compensate with strong 2FA, individual accounts per team member, and monitoring for login alerts. For your own internal admin panel that calls the Paystack API, you can add IP allowlisting at the infrastructure level.
How often should I rotate Paystack API keys?: At minimum: rotate on team member departure, on suspected exposure, or after any security incident. Some security policies mandate periodic rotation every 90 days regardless. More frequent rotation is safer but requires a reliable secrets deployment pipeline so you can update production without downtime.
Is the Paystack public key (pk_live_...) sensitive?: The public key is designed to be used in frontend code — it is not secret. You can safely include it in your JavaScript or mobile app. The secret key (sk_live_...) is what must be protected. Never expose the secret key in frontend code or public repositories.

Learn Paystack Integration

KES 2,999

The definitive guide to building payment systems with Paystack — from your first transaction to production-grade payment infrastructure across Africa. 9 modules, 47 lessons. Free preview available.

Start Paystack Course

Not ready? Create Free Account