Plugin Setup & API Keys

This guide covers how to get your API keys from the HL Hunt dashboard and configure them in plugins (WooCommerce, custom integrations, etc.).

Step 1: Get Your API Keys

Click Developers in the left sidebar.

Click Create API Key.

You'll get two keys:

- Secret key (sk_live_xxx) — Used server-side. Never expose this in frontend code. - Publishable key (pk_live_xxx) — Used client-side for tokenization and embedded checkout.

Important: Copy your Secret key immediately — it's only shown once. If lost, revoke it and create a new one.

Step 2: Test vs Live Keys

Key Prefix	Environment	Real money?
`sk_test_` / `pk_test_`	Sandbox	No — simulated transactions
`sk_live_` / `pk_live_`	Production	Yes — real charges

Always build and test with sk_test_ keys first. Switch to sk_live_ when you're ready to go live.

Step 3: WooCommerce Plugin Setup

Install the plugin:

- In WordPress, go to Plugins → Add New and search for HL Hunt in the plugin store. - Click Install Now → then Activate. - Alternatively, download the .zip from your HL Hunt dashboard (Developers → Plugins) and upload it via Plugins → Add New → Upload Plugin.

Configure keys:

- Go to WooCommerce → Settings → Payments → HL Hunt. - Toggle Enable HL Hunt to On. - Paste your Secret Key (sk_live_xxx) in the Secret Key field. - Paste your Publishable Key (pk_live_xxx) in the Publishable Key field. - Click Save Changes.

Test mode (optional):

- Toggle Test Mode to On. - Use your sk_test_ and pk_test_ keys to test without real charges. - Use test card 4111 1111 1111 1111 with any future expiry and CVC 123.

Enable payment plans (optional):

- Toggle Payment Plans / Arrangements to On. - Customers will see an installment option at checkout for eligible orders.

Step 4: Custom Integration (API)

For any custom integration:

bash

# Set your base URL
BASE_URL="https://api.hlhunt.org/v1"

# Test your key
curl $BASE_URL/customers \
  -H "Authorization: Bearer sk_live_your_api_key"

All API requests use:

Base URL: https://api.hlhunt.org/v1
Auth header: Authorization: Bearer sk_live_xxx
Content-Type: application/json

Step 5: Webhook Setup

To receive real-time notifications when events occur:

Go to Developers → Webhooks in your dashboard.

Click Add Endpoint.

Enter your server's webhook URL (e.g., https://yoursite.com/api/webhooks/hlhunt).

Select which events to subscribe to (or choose "All events").

Copy the Webhook Secret — use it to verify webhook signatures.

bash

# Verify the webhook signature — see the Webhook Security & Verification guide.
# Header: X-Webhook-Signature: t=<unix>,v1=<hex hmac>
# v1 = HMAC-SHA256 of  t + '.' + rawBody  using THIS endpoint's own signing secret
# (each endpoint has its own secret — there is no shared global secret).
const header = request.headers['x-webhook-signature'];
const parts = Object.fromEntries(header.split(',').map(kv => kv.split('=')));
const expected = crypto.createHmac('sha256', endpointSecret).update(parts.t + '.' + requestBody).digest('hex');
if (parts.v1 !== expected) return res.status(403).send('Invalid signature');

API Key Security Best Practices

Never commit keys to git — use environment variables.
Never expose secret keys in frontend code — only publishable keys are safe for the browser.
Rotate keys regularly — revoke old keys from the dashboard.
Use IP allowlists — restrict which IPs can use your key (Developers → Key Settings).
Set scoped permissions — limit a key to only the operations it needs.
Monitor usage — check the API logs in your dashboard for unusual activity.