API keys

Developers

The keys your servers present to call the API. This is where they are issued, rotated and revoked.

Test and live

A test key (sk_test_…) travels the whole platform without any money moving: it is the right first key for any integration. See also Test store and the Getting started guide.

A secret is shown once

The key is shown at creation and can never be retrieved again. Store it safely immediately. If it is lost there is no recovery — there is a rotation.

Request signing

Ticking Require signing generates a dedicated signing secret, itself shown only once. Every request carrying that key must then present:

X-NeoPays-Signature: t=<unix>,v1=<hex HMAC-SHA256(signing secret, t + "." + body)>

This is final for that key. To stop signing, you have to issue a new key.

Rotate rather than revoke

Rotate issues the new key straight away and lets the old one live through a grace period, long enough to deploy without interruption. A confirmation code is asked for, and it authorises that rotation only.

A grace period of zero days cuts the old key off the moment you confirm — any integration still using it stops at that instant.

Revoke is immediate and has no grace period.

Scopes

A key carries only the rights you give it: initiate payments, read transactions, pay out, refund, manage webhooks, read or write end customers. Give it the minimum its integration needs.

— /dashboard/api-keys