Each project has its own key – called either a secret key or a project key – that’s part of your digital signature, which is necessary for secure payments. To generate your digital signature we concatenate the request's JSON body with your project's secret key and apply SHA-1 hashing to the resulting string. 

The API key is the same for all projects in your account and is used for API calls you make to the Xsolla server. Your API key should only be held on your own server, never inside your game binaries or frontends.