Providers / Polar
Payments
Polar API keys and credentials
What every Polar credential a founder holds does, whether it expires, and what tends to break. Each fact links to Polar's own docs.
At a glance
| Credential | Expiry | Permissions |
|---|---|---|
| Polar dashboard login | Not documented | – |
| Organization access token (OAT) | You choose | Can be scoped |
| Webhook endpoint secret | Not documented | Full access only |
Each credential
Polar dashboard login
- Not documented
Dashboard login. Session and 2FA policy not documented on the pages reviewed.
Organization access token (OAT)
- You choose
- Can be scoped
Created under Settings > Access Tokens for one organization. When creating, you name the token, set an expiration date and select scopes. The docs give no presets, default, maximum or never option, so the lifetime range is unconfirmed. Tokens are bearer tokens and must stay server-side. Scope names are not listed on the page reviewed. Rotation and revocation are not covered on the page reviewed.
Webhook endpoint secret
- Not documented
- Full access only
You either supply your own secret or Polar generates one. Polar signs requests with it. Secrets generated on or after 2026-09-08 00:00 UTC use Standard Webhooks headers (webhook-id, webhook-timestamp, webhook-signature); older secrets use Polar's HMAC scheme with the full whsec_ string as key. Polar SDKs 1.0.0-alpha.19 and later try both keys. Rotation and expiry are not documented.
What usually goes wrong
- OAT created with a short expiration date expires without warning and API calls start failing
- OAT with too few scopes returns authorization errors after a feature is added
- Webhook secret handled as the wrong format after Polar's Standard Webhooks cutover, so signature checks fail
- OAT committed to a repository or exposed in client-side code
- Stripe payout fees reduce expected revenue because they are charged on top of Polar's transaction fees
Renewals and billing
- Polar paid plan (Pro, Growth or Scale), billed monthly. Starter is free. Paid plans are listed at $20/mo (Pro), $100/mo (Growth) and $400/mo (Scale), each with a lower transaction fee.
Metrics endpoint (GET /v1/metrics/) gives revenue and subscriber metrics per interval (day, week, month, year, hour), with start_date and end_date. Orders endpoint (GET /v1/orders/) has amounts, platform fees and refunds per order, and includes customer name and email.
What Polar's docs don't say
We couldn't confirm these from official docs, so don't rely on them either way:
- OAT default expiration, maximum lifetime, and whether a never-expiring option exists
- Whether OAT expiry is shown in the dashboard or readable via the API
- Full list of OAT scope names and whether scopes can be edited after creation
- Whether OAT revocation is available in the dashboard
- Webhook secret rotation and expiry
- Dashboard login session lifetime and 2FA policy
- Whether usage or spend data is available through the API
- Full OAT scope list and whether metrics:read can be chosen alone in the UI
- Whether the metrics response contains any customer personal data
- Whether OAT expiry options (default, max, never) exist
- Rate limit
- Whether an introspection endpoint exists (llms.txt index returned 404)
Rotating or replacing a Polar key
The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:
Sources
- polar.sh/docs/integrate/oat
- polar.sh/docs/integrate/webhooks/endpoints
- polar.sh/docs/integrate/webhooks/delivery
- polar.sh/docs/fees
- polar.sh/docs/api-reference/metrics/get
- polar.sh/docs/api-reference/orders/list
Related providers
Keep track of every Polar key
StackHangar stores your Polar keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.