Credentials

Credentials are unique access keys that we use to identify an integration in your account. They are directly linked to the application you created for that integration and allow you to securely authenticate operations with Mercado Pago.

Types of credentials

Credentials are divided into test credentials and production credentials. Use the credentials for the environment you are working in and replace them only when moving from testing to production.

Test credentials

Production credentials

Test credentials

Test credentials allow you to configure and validate the integration without processing real operations. They are created automatically with the application.

To access them, follow these steps:

1. Go to Integrations and select the application.
2. Select Test in the environment selector at the top of the screen.
3. Access the credentials through one of the following options:
   • In Home, locate the Credentials block.
   • In the side menu, select Credentials.

In both cases, you will find the Public Key and Access Token for the test environment, with options to copy them.

Type	Description
Public Key	Public key used in the frontend to initialize the integration and protect the data sent to Mercado Pago.
Access Token	Private key used in the backend to authenticate requests to Mercado Pago APIs. It must never be shared or exposed in the frontend.

For these integrations, the test Access Token starts with the APP_USR prefix. Before copying a credential, make sure the selector shows the Test environment.

On the Credentials screen, you will also find a separate block with the test account data and an option to manage it.

Share credentials

If someone is helping you integrate Mercado Pago products, you can securely share the application credentials with them.

To start the process, follow these steps:

1. Go to Integrations, select the application, and click Credentials in the side menu.
2. Select the Test or Production environment.
3. In the Share credentials with a developer section, click Share credentials.

You can undo this action by deleting the account that received the credentials and renewing them.

Renew credentials

You can renew production credentials for security reasons or to revoke shared access.

Renewal generates a new credential pair. Once completed, replace the previous credentials with the new ones everywhere they are used in the integration.

Security Recommendations

When integrating Mercado Pago solutions, you will handle sensitive data that you must protect from potential losses or vulnerabilities, such as your Mercado Pago access credentials, the keys you use in your integrations, or your customers' information.

We will show you how you can optimize the security of your integrations in a simple and quick way.

Send the Access Token by header

Every time you make API calls, send the Access Token via header instead of query param. This will allow you to protect it so that it is not exposed to anyone outside your integration.

For example, if you perform a GET request to the /users/me resource, it would be like this:

curl
curl -H 'Authorization: Bearer {{YOUR_ACCESS_TOKEN}}' \
https://api.mercadolibre.com/users/me

Use OAuth to manage third-party credentials

OAuth is an authorization protocol that allows applications to securely access user accounts in HTTP services without requiring the user to directly share their credentials. It works as an intermediary that facilitates controlled access to user data by third-party applications.

For more information, access the documentation.