Skip to main content
PayGlue turns a purchase at your payment provider into a member in Ghost. Ghost has exactly one door for that: the Admin API. There is no webhook, no import and no setting that lets an outside service create or update a member without it. So the key is not a convenience, it is the connection.

​
What PayGlue does with the key

Every call goes to your Ghost site’s Admin API, nowhere else. PayGlue uses the key to:
  • Look up a member by email when a webhook event comes in, so an existing member is updated instead of duplicated.
  • Create or update that member. Depending on your setup this means setting the member to comped or to free plus a label, and adding or removing the payglue-active, payglue-ended and payglue-provider:* labels described in Member labels.
  • Subscribe the member to the newsletters you chose in the mapping, and send the welcome email you picked.
  • Read your site’s settings for the health check on the connection page and to see whether Stripe is connected in Ghost, which decides between comped and free plus label. See The Stripe requirement.
That is the whole list. PayGlue never reads your posts, never changes your theme, never touches your staff users and never sends emails through Ghost on its own. The key is used when an event needs processing and when you press Run health check, not on a schedule.

​
What happens to the key

  • It is encrypted at rest with Fernet (AES-128-CBC with an HMAC-SHA256 integrity check) and decrypted only for the moment a call is made. Details in the Security overview.
  • After you save it, the dashboard shows dots. Nobody, including PayGlue staff, can read it back. To change it, paste a new one.
  • It stays in the EU. PayGlue runs on EU infrastructure and the key is never sent to a payment provider or any other third party.
  • Deleting your workspace or your account deletes the key with it.

​
How to keep control of it

Create the key as its own custom integration in Ghost (Settings → Integrations → Add custom integration) and name it PayGlue. Then the key belongs to PayGlue alone: you can see in Ghost that it exists, and you can revoke it without touching anything else. If you regenerate the key in Ghost, PayGlue’s copy stops working. Purchases keep arriving, but they can no longer be turned into members. The health check goes red, the events on your Analytics → Webhook Events page show a delivery failure, and PayGlue emails you once the failures repeat. Paste the new key on the Ghost connection page and the queued events are retried.

​
The provider API key is optional

Some provider pages in PayGlue ask for a second key, an API key or token from the payment provider. That one is not required for the sync. Webhooks are what carry purchases into PayGlue, and those work with the webhook secret alone. The provider key does one thing: it lets PayGlue fetch your product list, so the Buy Button, Paywall and Pricing Table editors show a dropdown instead of a text field. Without it you paste the product ID by hand, and everything else works the same. Where it is used, it is read-only. Some providers have no such API at all (Ko-fi, for example), and there the text field is the only option anyway.