Why You Should Never Give an LLM Your Paystack Secret Key

When you paste text into an LLM chat or prompt, that text may be:

• Logged by the AI provider for safety monitoring, abuse detection, or support. Many providers retain prompts for 30-90 days. Your key is in those logs.
• Used for fine-tuning if you use a service without data opt-out, or if you accepted default terms. Rare but possible for consumer-tier products.
• Visible to others if you share the conversation, if the chat is on a shared account, or if the AI provider has a breach.
• Outside your audit trail — your Paystack dashboard shows which IPs used the key, but not "Claude used this in a chat on 2026-07-22."

A Paystack live secret key can: initialize transactions, charge cards via the Charge API, trigger transfers to bank accounts, access all your customer and transaction data, and create subaccounts. One exposed key can drain your Paystack balance.

Give the LLM a tool (function) to call, not the key directly. The tool lives on your server where the key is safe:

// Server-side tool definition (for Claude API function calling)
const tools = [
  {
    name: 'get_transactions',
    description: 'Fetch recent Paystack transactions. Returns list of transactions.',
    input_schema: {
      type: 'object',
      properties: {
        limit: { type: 'number', description: 'Number of transactions to fetch (max 100)' },
        status: { type: 'string', enum: ['success', 'failed', 'pending'] },
      },
    },
  },
];

// When Claude calls this tool, you execute it with the key on your server
async function handleToolCall(toolName, toolInput) {
  if (toolName === 'get_transactions') {
    var res = await fetch('https://api.paystack.co/transaction?perPage=' + (toolInput.limit || 20), {
      headers: { Authorization: 'Bearer ' + process.env.PAYSTACK_SECRET_KEY }, // key never leaves server
    });
    return (await res.json()).data;
  }
}

The LLM sees the tool results (transaction data), never the key. The key stays in your environment variable, on your server, under your control.

See agentic payout safety rails for broader AI payment security.

Sign up for the McTaba newsletter