Overview
Shared secret API keys in Veriff Station are displayed only at the moment of creation. Once you dismiss the key display prompt, the key cannot be retrieved from Station again.
This applies to:
Newly created shared secret keys: When you create a new key, you will be prompted to copy and securely store it immediately. After dismissing the prompt, the key will no longer be viewable.
Auto-generated keys for new integrations: When a new integration is created, a shared secret key is automatically generated. You will be able to view this key only once. The Station UI makes this explicit with a confirmation prompt before revealing the key.
Important: Your keys always continue to function regardless of their visibility in Station. The display behavior is a security measure.
Why are keys shown only once?
Key benefits include:
Enhanced security — You maintain full control of your keys. There are many secrets managers built for this purpose.
Industry compliance — This follows recommendations from SOC 2, ISO 27001, PCI DSS, and NIST SP 800-57, which emphasize least-privilege access to credentials.
Reduced risk — An attacker with UI access cannot extract existing secrets — only create new ones (which is auditable and revertible).
How do shared secret keys work?
Creating a new shared secret key
Navigate to All integrations, then select your integration.
Go to the API Keys tab under Installation Settings.
Under Shared secret keys, click + Add key.
Enter a name for your key (required). This name helps you identify the key later since the secret will not be visible after creation.
Click Create.
A prompt will appear displaying your new shared secret key. Copy it immediately and store it in a secure location.
Click "I've copied the key" to confirm.
⚠️ Important: This is the only time you will see this key. Copy it to a secure location now. It cannot be recovered later.
Viewing an auto-generated key (first time only)
When a new integration is created, a shared secret key is automatically generated. The first time you access the API Keys section:
You will see a prompt: "Show this shared secret key?"
The prompt warns: "This key will only be shown once. Copy and save it securely now. It cannot be retrieved later."
Click Show key to reveal the key.
Copy the key and store it securely.
Click "I've copied the key" to confirm.
Once any user on your account views the key, it will be hidden for all users on that account.
After viewing
Once a key has been viewed, the key displays as "Key no longer viewable" in Station.
FAQ
What if I lose my shared secret key?
If you no longer have your key stored, you won't be able to retrieve it from Station, but you can easily create a new one through key rotation. Full documentation on key rotation is available here: Shared secret key rotation
Best practices for storing keys
We recommend storing your shared secret keys in a dedicated secrets management solution.
Avoid storing keys in plaintext, unencrypted files, or source code repositories.
We also recommend adopting regular key rotation as an ongoing security practice.
Where can I find more information?
For additional questions, please reach out to your Account Manager or contact Veriff support.