Generating keys

You need three secrets and three identifiers per environment to call the ENSC API. The dashboard issues them together.

Before you start

Sandbox keys are available once your business profile is complete.
Live keys require an approved business verification, and you must add at least one IP address or range to the allowlist before a live key can be generated (see IP allowlist).

Steps

Sign in to the dashboard at app.prosperavest.com and choose Sandbox or Live.
Open the Credentials tab and click Generate keys.
For Live, enter the IP addresses or CIDR ranges your servers call ENSC from (up to 32).
The dashboard creates your API key, your encryption key and an Ed25519 signing keypair, registers the public half with ENSC, and shows the six values once:

ENSC_API_KEY=ensc_live_sk_…
ENSC_MERCHANT_ID=mrc_…
ENSC_ENCRYPTION_KEY=…            # 43 characters, base64url
ENSC_ENCRYPTION_KEY_ID=enc_…
ENSC_SIGNING_KEY_ID=sig_…
ENSC_SIGNING_PRIVATE_KEY=…       # 43 characters, base64url

Click Download .env (or Copy as .env) and store the values in your secret manager or environment, then tick I have stored these values. They cannot be shown again.

Using them

import { EnscClient } from '@ensc/sdk';

const ensc = new EnscClient({
  apiKey: process.env.ENSC_API_KEY!,
  merchantId: process.env.ENSC_MERCHANT_ID!,
  encryptionKey: process.env.ENSC_ENCRYPTION_KEY!,
  encryptionKeyId: process.env.ENSC_ENCRYPTION_KEY_ID!,
  signingPrivateKey: process.env.ENSC_SIGNING_PRIVATE_KEY!,
  signingKeyId: process.env.ENSC_SIGNING_KEY_ID!,
});

All six are required. The client validates their shape at construction and throws ENSC_VALIDATION_FAILED with the name of the field that is missing or malformed.

Value	Secret?	Purpose
`apiKey`	yes	`Authorization: Bearer`. Identifies the merchant, carries env + scopes. `ensc_live_sk_…` or `ensc_test_sk_…`.
`encryptionKey`	yes	32-byte AES-256-GCM key, base64url. Encrypts every request body before it leaves your server (ENSC-ENC-V1).
`encryptionKeyId`	no	The `enc_…` id of that key. Travels inside the envelope so the API knows which key to decrypt with.
`signingPrivateKey`	yes	Ed25519 seed, base64url. Signs every write (ENSC-V1) and is the key every sealed response is opened with (ENSC-RESP-V1).
`signingKeyId`	no	The id of the registered public key. Sent as `X-ENSC-Key-Id` on every request.
`merchantId`	no	`mrc_…`. Bound into every signature and every encrypted envelope.

Key types

Secret key (sk): full access for your backend. The type the dashboard generates.
Restricted key (rk): a secret key with a reduced permission set, for services that only need part of the API.
Publishable key (pk): browser-safe, read-only, limited to the origins you allow. Not used with the SDK.

The scopes a key can carry are listed in the Security overview.

Rotating and revoking

Each credential rotates independently from the dashboard:

Rotate issues a replacement and shows it once. The previous key keeps working for 24 hours, so deploy the new value, confirm traffic is healthy, and let the old one expire. The lists show the exact expiry (expiresAt).
Revoke stops a key immediately. Use it when a credential has leaked.

When you rotate the encryption key, update ENSC_ENCRYPTION_KEY and ENSC_ENCRYPTION_KEY_ID together. When you rotate the signing key, update ENSC_SIGNING_PRIVATE_KEY and ENSC_SIGNING_KEY_ID together. When you rotate a live API key, the new key inherits the old key’s IP allowlist. The SDK can list your keys (ensc.apiKeys.list(), ensc.encryptionKeys.list(), ensc.signingKeys.list()) but cannot create, rotate or revoke them; those actions are available only in the dashboard (ENSC_DASHBOARD_ONLY from an API key).

Losing a secret

There is no recovery. Rotate the affected key and update your deployment.

Get started

Security

Guides

Resources

Before you start

Steps

Using them

Key types

Rotating and revoking

Losing a secret

​Before you start

​Steps

​Using them

​Key types

​Rotating and revoking

​Losing a secret

Before you start

Steps

Using them

Key types

Rotating and revoking

Losing a secret