Securing Admin Access to Your Paystack Dashboard
Enable two-factor authentication (2FA) on every Paystack dashboard account — especially the admin account. Never share login credentials between team members: use Paystack's team invite feature so each person has a separate login with an appropriate role. Rotate your live secret key if any team member with access leaves. Monitor your API key usage for unexpected activity. Restrict the "Transfers" permission in the dashboard to as few accounts as possible.
Enabling Two-Factor Authentication
Two-factor authentication (2FA) stops most account takeover attacks — even if your password is stolen, an attacker cannot log in without the second factor.
- Log in to your Paystack dashboard at dashboard.paystack.com
- Click your account name (top right) → Account Settings
- Select Security → Enable 2FA
- Scan the QR code with an authenticator app (Google Authenticator, Authy, or 1Password)
- Enter the 6-digit code to confirm
- Save your backup codes in a secure location (not in email)
Require all team members with dashboard access to enable 2FA. An admin account without 2FA is a single password guess away from full compromise.
Using Team Invites Instead of Shared Credentials
Sharing a single login across your team means:
- You cannot audit who performed which action
- Offboarding requires a password change that locks everyone out temporarily
- One team member's compromised device exposes the shared account
Instead, use Paystack team invites:
- Go to Settings → Team in the Paystack dashboard
- Click Invite new member
- Enter the team member's email and select their role:
| Dashboard Role | Access |
|---|---|
| Admin | Full access: API keys, transfers, settings, team management |
| Developer | View transactions, access API keys, manage webhooks. Cannot initiate transfers. |
| Finance | View transactions and settlements, download reports. No API key access. |
Assign Finance role to customer support and accounting staff. Assign Developer role to engineers who need to debug transactions. Keep Admin accounts minimal — ideally one or two founders or senior engineers.
API Key Rotation and Storage
Your Paystack live secret key is equivalent to full access to your payment account. Treat it like a password:
- Store in secrets managers — AWS Secrets Manager, HashiCorp Vault, Vercel Environment Variables, or Supabase Secrets. Not in code, not in .env files committed to git.
- Rotate on team member departure — Generate a new secret key in Settings → API Keys whenever anyone with key access leaves.
- Rotate on suspected exposure — If the key appears in a log file, a leaked .env, or a public repo: generate a new key immediately, then update your production environment.
- Separate test and live keys — Your CI/CD pipeline should use test keys only. Live keys should only be in production environment secrets.
Learn More
This guide is part of the Paystack security guide.
Key Takeaways
- ✓Enable 2FA on your Paystack dashboard admin account — this is the single highest-impact security action you can take.
- ✓Never share dashboard credentials. Use Paystack team invites (Settings → Team) so each member has their own login with assigned role.
- ✓Three Paystack dashboard roles: Admin (full access), Developer (API keys, transaction view), Finance (transaction history, reports only).
- ✓Rotate your live secret key any time a team member with key access leaves, or whenever you suspect exposure.
- ✓Keep live and test API keys in a secrets manager, not in Slack messages, emails, or .env files committed to git.
- ✓Review your dashboard team member list every quarter — remove people who no longer need access.
Frequently Asked Questions
- What should I do if my Paystack dashboard is compromised?
- Act fast: (1) Log in and immediately go to Settings → API Keys → Regenerate your live secret key. (2) Go to Settings → Team and revoke any suspicious accounts or sessions. (3) Enable 2FA if not already done. (4) Review recent transactions and transfers for unauthorized activity. (5) Contact Paystack support to report the incident and get help identifying any unauthorized actions.
- Can I restrict which IP addresses can access the Paystack dashboard?
- Paystack does not currently offer IP allowlisting for dashboard access (as of 2026). Compensate with strong 2FA, individual accounts per team member, and monitoring for login alerts. For your own internal admin panel that calls the Paystack API, you can add IP allowlisting at the infrastructure level.
- How often should I rotate Paystack API keys?
- At minimum: rotate on team member departure, on suspected exposure, or after any security incident. Some security policies mandate periodic rotation every 90 days regardless. More frequent rotation is safer but requires a reliable secrets deployment pipeline so you can update production without downtime.
- Is the Paystack public key (pk_live_...) sensitive?
- The public key is designed to be used in frontend code — it is not secret. You can safely include it in your JavaScript or mobile app. The secret key (sk_live_...) is what must be protected. Never expose the secret key in frontend code or public repositories.
Ready to build real-world apps?
Join the McTaba Labs full-stack marathon (4 months full-time · 6 months part-time). Learn M-Pesa, USSD, and WhatsApp engineering while shipping 8 production apps.
Apply to the McTaba Marathon