Keys and activation

Each customer has two independent environments, test and live. Each has four kinds of credential:

Credential	What it is for	Where it lives	Visible
Public key pk_…	Identify the shop and environment	Settings, support	Always
Secret key sk_…	Authenticate server to server to the Magento connector	Magento (Yape Connector), encrypted	Only when created
Activation code	Link one phone to the shop	Typed or scanned once in the app	When generated
Device credential	Sign the phone’s requests	The phone’s Keystore	Phone only

The secret key never goes on the phone

A phone can be lost or stolen. That is why the app links with a one-time code and receives its own credentials, which can be revoked one by one without affecting the store.

Format and good practice

• Readable prefix by type and environment: pk_test_…, sk_live_…. Makes leaks easy to spot.
• We only store the secret’s hash; if you lose it, rotate it.
• A test key never works against live data, and vice versa.
• Overlapping rotation: create the new key, update the connector, revoke the old one once it is no longer used.
• You can restrict the secret key to an IP allowlist.
• The panel shows creation date, last use and origin of each key.

Activating a phone

sequenceDiagram
    autonumber
    participant O as Owner (panel)
    participant A as App
    participant P as Platform
    O->>P: Generates activation code
    P-->>O: One-time code (expires in 15 min)
    O->>A: Types or scans the code
    A->>P: activation(code, app version)
    P-->>A: device_id, device secret, license
    A->>A: Stores the secret in Android Keystore

• The code is single-use, expires in 15 minutes and has limited attempts.
• It fails if the license is suspended or expired, or the device limit is reached (1 by default).
• Activating another phone replaces the previous one, which is revoked.

License

State	Effect
Active	Works normally
Grace	Offline, the app stays valid ~7 days after the last good heartbeat
Suspended / expired	The platform rejects uploads (403); the app keeps saving locally and sends the backlog once reactivated