Credentials: obtaining and storing

Where they come from (a manual merchant step - an agent cannot do this): https://aura.roki.systems/merchant/connect/api-integration -> pick the environment with the Sandbox (prueba) / En vivo (produccion) toggle -> copy the secret key.

The portal shows the full secret key exactly once (on first setup, or after Regenerar). After that it is masked. If it was not saved, the only way out is regenerating - and the previous key stops working immediately, breaking any integration using it.

Where to store them in your project: in a configuration table read at runtime (for example integration_settings with roki_secret_key, roki_webhook_secret, roki_environment), encrypted at rest if the project already encrypts secrets. That way, rotating a key means updating one record - ideally from the admin panel - with no code change and no redeploy. Environment variables are the fallback when the project has no configuration table.

Never: in the repository, in browser code, or cached in code constants.