Recommended path
Ship a native mobile app that talks to your own server backend. The backend holds the developer-app credential and issues POST /v1/payments, so the mobile binary contains no embedded secret.
Developer preview API v1
Sandbox only. No real funds moved. No production access is granted here. Access requirements
Mobile app
Keep secrets out of the mobile binary
The native app authenticates through your backend, and the backend holds the credential so the app contains no embedded secret.
Authenticate the user, not the device
The app authenticates the signed-in customer with your backend, which maps the session to merchant mer_01900000000000000000000000. Payment state and fulfilment stay server-authoritative.
Prohibited
Do not compile a live credential or a credential-shaped live key into the app, include it in an app config bundle, or accept it from a customer-editable deep link. Do not call the payment endpoint from the device with a shared secret.